CVE-2026-93056

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93056", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T15:57:05.659Z", "datePublished": "2026-09-17T16:10:44.442Z", "dateUpdated": "2026-10-19T09:04:52.242Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:04:52.242Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: remove broken string configfs attributes\n\nThe UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for\nthe fn_play, fn_cap, and fn_cntl string options. The store function\ncontains an inverted null check on the kstrndup() return value.\n\nThis means every write attempt returns -ENOMEM on success and\ndereferences a NULL pointer on allocation failure. The attributes\nhave been broken and unused for many years.\n\nRemove the UAC1_STR_ATTRIBUTE macro and the three attributes it\ngenerated. The internal defaults (FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE,\nFILE_CONTROL) set in f_audio_alloc_inst() are unaffected."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["Documentation/ABI/testing/configfs-usb-gadget-uac1_legacy", "Documentation/usb/gadget-testing.rst", "drivers/usb/gadget/function/f_uac1_legacy.c", "drivers/usb/gadget/function/u_uac1_legacy.h"], "versions": [{"version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "lessThan": "745adfe6c337f3d5d7737d57529d14a208151b45", "status": "affected", "versionType": "git"}, {"version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "lessThan": "6351ba62778f72dc4f6bc18bfa99e618829cff0d", "status": "affected", "versionType": "git"}, {"version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "lessThan": "021b58ac3e58cffa68ed9585ff492a19e98414f6", "status": "affected", "versionType": "git"}, {"version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "lessThan": "fd43eae7d539ea7cfc7c9f0d3f0eaa890415e8a7", "status": "affected", "versionType": "git"}, {"version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "lessThan": "8b9335aec93975bb9186d63993a5a610e5066ffc", "status": "affected", "versionType": "git"}, {"version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "lessThan": "2ed25c9d4400cf90d9201657963a231c27a5ea57", "status": "affected", "versionType": "git"}, {"version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "lessThan": "977659adb341f6e30fb00dcf183f63f29df879e2", "status": "affected", "versionType": "git"}, {"version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "lessThan": "590d74ec8f488e06b9f1c0f8f0941f45531f3a55", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["Documentation/ABI/testing/configfs-usb-gadget-uac1_legacy", "Documentation/usb/gadget-testing.rst", "drivers/usb/gadget/function/f_uac1_legacy.c", "drivers/usb/gadget/function/u_uac1_legacy.h"], "versions": [{"version": "3.18", "status": "affected"}, {"version": "0", "lessThan": "3.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/745adfe6c337f3d5d7737d57529d14a208151b45"}, {"url": "https://git.kernel.org/stable/c/6351ba62778f72dc4f6bc18bfa99e618829cff0d"}, {"url": "https://git.kernel.org/stable/c/021b58ac3e58cffa68ed9585ff492a19e98414f6"}, {"url": "https://git.kernel.org/stable/c/fd43eae7d539ea7cfc7c9f0d3f0eaa890415e8a7"}, {"url": "https://git.kernel.org/stable/c/8b9335aec93975bb9186d63993a5a610e5066ffc"}, {"url": "https://git.kernel.org/stable/c/2ed25c9d4400cf90d9201657963a231c27a5ea57"}, {"url": "https://git.kernel.org/stable/c/977659adb341f6e30fb00dcf183f63f29df879e2"}, {"url": "https://git.kernel.org/stable/c/590d74ec8f488e06b9f1c0f8f0941f45531f3a55"}], "title": "usb: gadget: f_uac1_legacy: remove broken string configfs attributes", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["Documentation/ABI/testing/configfs-usb-gadget-uac1_legacy", "Documentation/usb/gadget-testing.rst", "drivers/usb/gadget/function/f_uac1_legacy.c", "drivers/usb/gadget/function/u_uac1_legacy.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "745adfe6c337f3d5d7737d57529d14a208151b45", "status": "affected", "version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "versionType": "git"}, {"lessThan": "6351ba62778f72dc4f6bc18bfa99e618829cff0d", "status": "affected", "version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "versionType": "git"}, {"lessThan": "021b58ac3e58cffa68ed9585ff492a19e98414f6", "status": "affected", "version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "versionType": "git"}, {"lessThan": "fd43eae7d539ea7cfc7c9f0d3f0eaa890415e8a7", "status": "affected", "version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "versionType": "git"}, {"lessThan": "8b9335aec93975bb9186d63993a5a610e5066ffc", "status": "affected", "version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "versionType": "git"}, {"lessThan": "2ed25c9d4400cf90d9201657963a231c27a5ea57", "status": "affected", "version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "versionType": "git"}, {"lessThan": "977659adb341f6e30fb00dcf183f63f29df879e2", "status": "affected", "version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "versionType": "git"}, {"lessThan": "590d74ec8f488e06b9f1c0f8f0941f45531f3a55", "status": "affected", "version": "0854611a19ae4dfa56569e6f640017a1d2dd3312", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["Documentation/ABI/testing/configfs-usb-gadget-uac1_legacy", "Documentation/usb/gadget-testing.rst", "drivers/usb/gadget/function/f_uac1_legacy.c", "drivers/usb/gadget/function/u_uac1_legacy.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.18"}, {"lessThan": "3.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: remove broken string configfs attributes\n\nThe UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for\nthe fn_play, fn_cap, and fn_cntl string options. The store function\ncontains an inverted null check on the kstrndup() return value.\n\nThis means every write attempt returns -ENOMEM on success and\ndereferences a NULL pointer on allocation failure. The attributes\nhave been broken and unused for many years.\n\nRemove the UAC1_STR_ATTRIBUTE macro and the three attributes it\ngenerated. The internal defaults (FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE,\nFILE_CONTROL) set in f_audio_alloc_inst() are unaffected."}], "id": "CVE-2026-93056", "lastModified": "2026-10-19T10:16:55.487", "metrics": {}, "published": "2026-09-17T17:17:59.190", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/021b58ac3e58cffa68ed9585ff492a19e98414f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2ed25c9d4400cf90d9201657963a231c27a5ea57"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/590d74ec8f488e06b9f1c0f8f0941f45531f3a55"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6351ba62778f72dc4f6bc18bfa99e618829cff0d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/745adfe6c337f3d5d7737d57529d14a208151b45"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8b9335aec93975bb9186d63993a5a610e5066ffc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/977659adb341f6e30fb00dcf183f63f29df879e2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fd43eae7d539ea7cfc7c9f0d3f0eaa890415e8a7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: usb: gadget: f_uac1_legacy: remove broken string configfs attributes", "id": "2536811", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536811"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel. Specifically, within the USB gadget audio class 1 (UAC1) legacy driver, a programming error related to handling string attributes could lead to a critical system failure. A local attacker could trigger this vulnerability by attempting to write to certain configuration settings, causing the system to crash and resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-93056", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93056\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93056\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93056.mbox"], "statement": "This Moderate flaw in the Linux kernel's USB gadget audio class 1 (UAC1) legacy function does not affect Red Hat supported products. The vulnerable code related to broken string configfs attributes is not present in Red Hat Enterprise Linux, OpenShift Container Platform, or Red Hat In-Vehicle OS.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0854611a19ae4dfa56569e6f640017a1d2dd3312,745adfe6c337f3d5d7737d57529d14a208151b45)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0854611a19ae4dfa56569e6f640017a1d2dd3312,6351ba62778f72dc4f6bc18bfa99e618829cff0d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0854611a19ae4dfa56569e6f640017a1d2dd3312,021b58ac3e58cffa68ed9585ff492a19e98414f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0854611a19ae4dfa56569e6f640017a1d2dd3312,fd43eae7d539ea7cfc7c9f0d3f0eaa890415e8a7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0854611a19ae4dfa56569e6f640017a1d2dd3312,8b9335aec93975bb9186d63993a5a610e5066ffc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0854611a19ae4dfa56569e6f640017a1d2dd3312,2ed25c9d4400cf90d9201657963a231c27a5ea57)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0854611a19ae4dfa56569e6f640017a1d2dd3312,977659adb341f6e30fb00dcf183f63f29df879e2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0854611a19ae4dfa56569e6f640017a1d2dd3312,590d74ec8f488e06b9f1c0f8f0941f45531f3a55)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.270,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.221,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.188,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.157,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.110,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.52,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.6,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-19T13:15:16.787804+00:00", "updated": "2026-09-22T01:30:17.348018+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}