CVE-2026-93056 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_uac1_legacy: remove broken string configfs attributes
The UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for the fn_play, fn_cap, and fn_cntl string options. The store function contains an inverted null check on the kstrndup() return value.
This means every write attempt returns -ENOMEM on success and dereferences a NULL pointer on allocation failure. The attributes have been broken and unused for many years.
Remove the UAC1_STR_ATTRIBUTE macro and the three attributes it generated. The internal defaults (FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE, FILE_CONTROL) set in f_audio_alloc_inst() are unaffected.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's USB gadget subsystem contains a legacy audio class driver implementation known as f_uac1_legacy which manages Universal Audio Class version 1 device emulation over USB connections. This module exposes configuration attributes through the configfs interface, allowing system administrators and userspace applications to customize string descriptors such as those for playback functions, capture functions, and control interfaces. These attributes are defined using a macro called UAC1_STR_ATTRIBUTE that generates both show and store handlers for reading and writing these specific string options. The presence of this code path represents an older architectural approach to configuring USB gadget devices before more modern configuration mechanisms were fully adopted in the kernel ecosystem.
A critical technical flaw exists within the store handler function generated by the UAC1_STR_ATTRIBUTE macro, specifically regarding memory allocation error handling logic. When a user attempts to write data to these configfs attributes, the code invokes kstrndup to allocate and copy the input string into kernel space. The vulnerability arises from an inverted null check on the return value of this allocation function. In standard C programming patterns for Linux kernel development, kstrndup returns NULL upon failure to allocate memory and a valid pointer on success. However, the flawed implementation treats a non-NULL result as a failure condition while treating a NULL result as a successful operation. This logical inversion creates two distinct operational failures depending on whether memory allocation succeeds or fails during write operations.
When memory allocation succeeds, which is the typical case under normal operating conditions with sufficient available RAM, the inverted check incorrectly interprets this success as an error and returns -ENOMEM to userspace. The -ENOMEM error code indicates out of memory errors, thereby falsely signaling that the operation failed due to resource exhaustion even though the data was successfully copied into kernel buffers. This behavior renders the configuration attributes effectively useless for their intended purpose since any attempt to modify these settings will always report failure to the calling application. Users attempting to configure USB audio device strings through this interface will consistently encounter errors despite having adequate system resources available, preventing proper device customization and potentially breaking automated deployment scripts that rely on successful attribute writes.
Conversely, when memory allocation fails due to actual resource constraints or fragmentation, the inverted null check interprets the NULL return value as success rather than failure. In this scenario, the code proceeds to dereference the NULL pointer in subsequent operations expecting a valid string reference. This results in a kernel NULL pointer dereference which typically causes an immediate crash of the calling process and potentially destabilizes the entire system depending on execution context and protection mechanisms enabled by CONFIG_DEBUG_NULL_PTR_DEREF or similar security features. Such null pointer dereferences represent severe stability issues that can lead to denial of service conditions where legitimate services are terminated unexpectedly, compromising system reliability and availability for critical infrastructure components relying on stable kernel operation.
The operational impact extends beyond immediate crashes because these attributes have been broken and unused for many years within the Linux ecosystem. The presence of dead code paths increases the attack surface by maintaining executable logic that serves no functional purpose while introducing potential crash vectors. Security analysts consider such legacy configurations as technical debt that complicates maintenance efforts and obscures the true state of system configuration capabilities. Organizations deploying USB gadget devices in production environments may find their automation pipelines failing due to these erroneous error codes, leading to operational inefficiencies and increased troubleshooting overhead for engineering teams attempting to diagnose why standard configuration commands consistently report failures despite correct syntax and sufficient resources.
From a vulnerability classification perspective, this issue aligns with CWE-835 which describes logic errors involving inverted conditions that lead to unexpected behavior in software execution flows. The null pointer dereference component corresponds closely to CWE-476 concerning NULL pointer dereferences resulting from improper validation of allocation results. In terms of the MITRE ATT&CK framework, this vulnerability relates to techniques under TA0005 Defense Evasion where attackers might exploit such flaws for denial of service attacks against systems running vulnerable kernel versions. The lack of proper error handling represents a fundamental weakness in defensive coding practices that should have been identified during initial code review or subsequent security audits targeting the USB gadget subsystem.
The resolution involves removing the UAC1_STR_ATTRIBUTE macro entirely along with the three configfs attributes it generates for fn_play, fn_cap, and fn_cntl string options. This cleanup eliminates both the inverted null check logic and the associated NULL pointer dereference risk without affecting internal default values set in f_audio_alloc_inst such as FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE, and FILE_CONTROL which remain intact through alternative initialization paths. By excising this broken code path, developers reduce complexity within the USB gadget subsystem while eliminating a vector for potential denial of service attacks via memory allocation manipulation or forced resource exhaustion scenarios targeting these specific attributes.
Mitigation strategies for organizations running affected kernel versions include applying upstream patches that remove the problematic macro and associated attribute definitions as soon they become available through distribution update channels. For environments where immediate patching is not feasible, administrators should avoid using configfs to modify USB audio string descriptors via f_uac1_legacy since these operations will consistently fail or crash depending on memory availability conditions. Monitoring system logs for NULL pointer dereference traces and -ENOMEM errors related to USB gadget configuration can help identify exploitation attempts or accidental triggers of this vulnerability in production environments before they cause significant service disruptions.
Long-term remediation requires auditing other legacy configfs attributes across the kernel codebase for similar inverted null check patterns that could introduce comparable stability risks. Developers should implement rigorous static analysis rules targeting kstrndup and related allocation functions to ensure proper validation of return values against NULL rather than treating non-NULL as failure conditions. Training engineering teams on secure coding practices specific to Linux kernel development helps prevent recurrence of such logical inversions in future contributions to subsystems managing hardware configuration interfaces through userspace-facing APIs like configfs.