{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "fe5a6c48fd954489f51aab151d5dad9254c76419"
            },
            {
              "fixed": "9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957"
            },
            {
              "fixed": "b9b5b5df5b8dd3c1572ed267200276a44cc67d8e"
            },
            {
              "fixed": "2c0f5ca48674a5b5f9fa4a9c3325aa48053af0bc"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.8.0"
            },
            {
              "fixed": "6.18.52"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90023.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()\n\nPreviously fsg_num_buffers_validate() was removed as it was not\nnecessary due to Kconfig setting the limits for n from 2 to 256 with\ndefault as 2. However, setting the page content in such a way that\nkstrtou8() reflects n value as either 0 or 1 bypasses these\nrestrictions leading to a null pointer dereference if n is 0. Fix\nthis by adding a check for n \u003c 2 and returning -EINVAL if n is\neither 0 or 1 consistent with Kconfig logic.",
  "id": "CVE-2026-90023",
  "modified": "2026-09-18T03:30:38.372058938Z",
  "published": "2026-09-16T10:33:26.905Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2c0f5ca48674a5b5f9fa4a9c3325aa48053af0bc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b9b5b5df5b8dd3c1572ed267200276a44cc67d8e"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90023.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90023"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()"
}