CVE-2025-38497

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-38497
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38497.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38497
Downstream
Related
Published
2025-07-28T12:15:31Z
Modified
2025-08-30T18:01:35Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: configfs: Fix OOB read on empty string write

When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length 'l' is greater than zero.

This patch fixes the vulnerability by adding a check at the beginning of osdescqwsignstore() and webusblandingPagestore() to handle the zero-length input case gracefully by returning immediately.

References

Affected packages