CVE-2026-93120

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qw_sign os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN as the input length to utf16s_to_utf8s(), but that argument counts UTF-16 code units while OS_STRING_QW_SIGN_LEN (14) is the byte size of qw_sign[]. The array holds only OS_STRING_QW_SIGN_LEN / 2 (7) code units, so the conversion reads up to 7 units (14 bytes) past the end of qw_sign[] into the following members of struct gadget_info when the stored signature fills the array without a NUL terminator, exposing those bytes through the configfs attribute. The store path halves the count for its input bound but passes the full byte count as the utf8s_to_utf16s() output limit; use the destination code-unit count in both directions.

Is your site exposed to CVE-2026-93120?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0021

Probability of exploitation

0.11%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/36315a330e067f7773196940552feacb1debbef1 https://git.kernel.org/stable/c/7e94cb967778e074411940db4db97f22ed77560c https://git.kernel.org/stable/c/9b45125501aad2dff7730970461b455b0e0658ee https://git.kernel.org/stable/c/a28c486434634f6d1e120711d2b09f3eddea6c98 https://git.kernel.org/stable/c/afbf39c0f2297c6abef6d670a82a2079b0836191 https://git.kernel.org/stable/c/b895dbed8ac9e12a5ffa1a2165575a8469f8340d https://git.kernel.org/stable/c/f63edb54d8f738f9c21e2068c777ae1c097df6b7 https://git.kernel.org/stable/c/f6da500b0f8106882598b6dec87fe37d653946cf

Frequently Asked Questions

What is CVE-2026-93120? +

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qw_sign os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN as the input length to utf16s_to_utf8s(), but that argument counts UTF-16 code units while OS_STRING_QW_SIGN_LEN (14) is the byte size of qw_sign[]. The array holds only OS_STRING_QW_SIGN_LEN / 2 (7) code units, so the conversion reads up to 7 units (14 bytes) past the end of qw_sign[] into the following members of struct gadget_info when the stored signature fills the array without a NUL terminator, exposing those bytes through the configfs attribute. The store path halves the count for its input bound but passes the full byte count as the utf8s_to_utf16s() output limit; use the destination code-unit count in both directions.

How do I check if I'm vulnerable to CVE-2026-93120? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.