In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: configfs: Fix OOB read on empty string write
When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length 'l' is greater than zero.
This patch fixes the vulnerability by adding a check at the beginning of osdescqwsignstore() and webusblandingPagestore() to handle the zero-length input case gracefully by returning immediately.
[
{
"digest": {
"length": 448.0,
"function_hash": "118441164211921727871436936013795024451"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58bdd5160184645771553ea732da5c2887fc9bd1",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "os_desc_qw_sign_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-0f006200"
},
{
"digest": {
"length": 446.0,
"function_hash": "236576789810729485526539613238266560598"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3014168731b7930300aab656085af784edc861f6",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "os_desc_qw_sign_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-21479b71"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"116817243805455128509072865614742360015",
"264411178711228456797588303314359604908",
"151017243462854970253371349318995071735",
"331998728015825224357820158955922522887",
"203086084084960275655275677701999394425",
"67938716294353505525682964851354576344"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58bdd5160184645771553ea732da5c2887fc9bd1",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c"
},
"signature_type": "Line",
"id": "CVE-2025-38497-27c73f37"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"331998728015825224357820158955922522887",
"203086084084960275655275677701999394425",
"67938716294353505525682964851354576344"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15a87206879951712915c03c8952a73d6a74721e",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c"
},
"signature_type": "Line",
"id": "CVE-2025-38497-307666dc"
},
{
"digest": {
"length": 853.0,
"function_hash": "102719382734999622960832893660861059222"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3014168731b7930300aab656085af784edc861f6",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "webusb_landingPage_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-315d0eee"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"116817243805455128509072865614742360015",
"264411178711228456797588303314359604908",
"151017243462854970253371349318995071735",
"329839304167523115822157591155833478948",
"97883546054109597739635552762529136670",
"133477285188526454297688437763184854829"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22b7897c289cc25d99c603f5144096142a30d897",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c"
},
"signature_type": "Line",
"id": "CVE-2025-38497-3b3f35cc"
},
{
"digest": {
"length": 448.0,
"function_hash": "118441164211921727871436936013795024451"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2798111f8e504ac747cce911226135d50b8de468",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "os_desc_qw_sign_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-48102a5a"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"331998728015825224357820158955922522887",
"203086084084960275655275677701999394425",
"67938716294353505525682964851354576344"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2798111f8e504ac747cce911226135d50b8de468",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c"
},
"signature_type": "Line",
"id": "CVE-2025-38497-52e55391"
},
{
"digest": {
"length": 853.0,
"function_hash": "102719382734999622960832893660861059222"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58bdd5160184645771553ea732da5c2887fc9bd1",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "webusb_landingPage_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-59ffbab5"
},
{
"digest": {
"length": 448.0,
"function_hash": "118441164211921727871436936013795024451"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d68b7c8fefbaeae8f065b84e40cf64baf4cc0c76",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "os_desc_qw_sign_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-6797ae70"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"116817243805455128509072865614742360015",
"264411178711228456797588303314359604908",
"151017243462854970253371349318995071735",
"329839304167523115822157591155833478948",
"97883546054109597739635552762529136670",
"133477285188526454297688437763184854829"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3014168731b7930300aab656085af784edc861f6",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c"
},
"signature_type": "Line",
"id": "CVE-2025-38497-6f32f7bc"
},
{
"digest": {
"length": 853.0,
"function_hash": "102719382734999622960832893660861059222"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@783ea37b237a9b524f1e5ca018ea17d772ee0ea0",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "webusb_landingPage_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-9145e39d"
},
{
"digest": {
"length": 448.0,
"function_hash": "118441164211921727871436936013795024451"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78b41148cfea2a3f04d87adf3a71b21735820a37",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "os_desc_qw_sign_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-91bcdb86"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"331998728015825224357820158955922522887",
"203086084084960275655275677701999394425",
"67938716294353505525682964851354576344"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d68b7c8fefbaeae8f065b84e40cf64baf4cc0c76",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c"
},
"signature_type": "Line",
"id": "CVE-2025-38497-9e21f190"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"331998728015825224357820158955922522887",
"203086084084960275655275677701999394425",
"67938716294353505525682964851354576344"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78b41148cfea2a3f04d87adf3a71b21735820a37",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c"
},
"signature_type": "Line",
"id": "CVE-2025-38497-9e958bbb"
},
{
"digest": {
"length": 448.0,
"function_hash": "118441164211921727871436936013795024451"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15a87206879951712915c03c8952a73d6a74721e",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "os_desc_qw_sign_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-c49eaded"
},
{
"digest": {
"length": 448.0,
"function_hash": "118441164211921727871436936013795024451"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@783ea37b237a9b524f1e5ca018ea17d772ee0ea0",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "os_desc_qw_sign_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-d3729991"
},
{
"digest": {
"length": 446.0,
"function_hash": "236576789810729485526539613238266560598"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22b7897c289cc25d99c603f5144096142a30d897",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "os_desc_qw_sign_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-ebce9422"
},
{
"digest": {
"length": 853.0,
"function_hash": "102719382734999622960832893660861059222"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22b7897c289cc25d99c603f5144096142a30d897",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c",
"function": "webusb_landingPage_store"
},
"signature_type": "Function",
"id": "CVE-2025-38497-f1837dfd"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"116817243805455128509072865614742360015",
"264411178711228456797588303314359604908",
"151017243462854970253371349318995071735",
"331998728015825224357820158955922522887",
"203086084084960275655275677701999394425",
"67938716294353505525682964851354576344"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@783ea37b237a9b524f1e5ca018ea17d772ee0ea0",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/gadget/configfs.c"
},
"signature_type": "Line",
"id": "CVE-2025-38497-fe5b337f"
}
]