CVE-2026-93056

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_uac1_legacy: remove broken string configfs attributes

The UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for

the fn_play, fn_cap, and fn_cntl string options. The store function

contains an inverted null check on the kstrndup() return value.

This means every write attempt returns -ENOMEM on success and

dereferences a NULL pointer on allocation failure. The attributes

have been broken and unused for many years.

Remove the UAC1_STR_ATTRIBUTE macro and the three attributes it

generated. The internal defaults (FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE,

FILE_CONTROL) set in f_audio_alloc_inst() are unaffected.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References