In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
The GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint
number from the host-supplied wIndex without any sort of validation.
Fix this up by validating the number of endpoints actually match up with
the number the device has before attempting to dereference a pointer
based on this math.
This is just like what was done in commit ee0d382feb44 ("usb: gadget:
aspeed_udc: validate endpoint index for ast udc") for the aspeed driver.
References
Configurations
Configuration 1 (hide)
|
History
28 Apr 2026, 17:14
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux
Linux linux Kernel |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CWE | CWE-476 | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| References | () https://git.kernel.org/stable/c/1b2bfedccc4fb8c9572e1ea464f905424c91de2a - Patch | |
| References | () https://git.kernel.org/stable/c/37f430b2240655e6b0199a92aa1057e4d621be51 - Patch | |
| References | () https://git.kernel.org/stable/c/44216e3dd4455b798899b50eedb0ec3831dff8e0 - Patch | |
| References | () https://git.kernel.org/stable/c/adb8014599fdf0818d3d93f1f74e06cd0bdec08d - Patch | |
| References | () https://git.kernel.org/stable/c/e3d42598f2995cdc07b7779874e7c5f8a1b773db - Patch | |
| References | () https://git.kernel.org/stable/c/f880aac8a57ebd92abfa685d45424b2998ac1059 - Patch |
27 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Apr 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-24 15:16
Updated : 2026-04-28 17:29
NVD link : CVE-2026-31615
Mitre link : CVE-2026-31615
CVE.ORG link : CVE-2026-31615
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-476
NULL Pointer Dereference