{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.96-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.4-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler  The OTG branch of composite_setup() falls back to the first configuration when none is selected:  \tif (cdev-\u003econfig) \t\tconfig = cdev-\u003econfig; \telse \t\tconfig = list_first_entry(\u0026cdev-\u003econfigs, \t\t\t\t\t  struct usb_configuration, list); \tif (!config) \t\tgoto done; \t... \tmemcpy(req-\u003ebuf, config-\u003edescriptors[0], value);  list_first_entry() never returns NULL. On an empty list it returns container_of() of the list head. So the \"if (!config)\" check is dead.  When cdev-\u003econfigs is empty, config points at the head inside struct usb_composite_dev. config-\u003edescriptors[0] reads whatever sits at that offset. The memcpy copies up to w_length bytes of it into the response buffer.  cdev-\u003econfigs can be empty in two cases. One is a teardown race on gadget unbind with a control transfer in flight. The other is a driver that sets is_otg before it adds a config. A reproducer that holds cdev-\u003econfigs empty triggers a KASAN fault in this branch.  Use list_first_entry_or_null() so the existing check does its job.",
  "id": "DEBIAN-CVE-2026-64347",
  "modified": "2026-09-14T16:47:35.363397988Z",
  "published": "2026-07-25T10:17:16.893Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64347"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64347"
  ]
}