Homepage

CVE-2026-98764 Affecting kernel-livepatch-6_4_0-150700_53_90-default package, versions <1-150700.15.3.1

Severity

 Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.18% (8th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES157-KERNELLIVEPATCH6401507005390DEFAULT-22247623
  • published5 Nov 2026
  • disclosed3 Nov 2026
Report a new vulnerability Found a mistake?

Introduced: 3 Nov 2026

NewCVE-2026-98764  (opens in a new tab)

How to fix?

Upgrade SLES:15.7 kernel-livepatch-6_4_0-150700_53_90-default to version 1-150700.15.3.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-livepatch-6_4_0-150700_53_90-default package and not the kernel-livepatch-6_4_0-150700_53_90-default package as distributed by SLES. See How to fix? for SLES:15.7 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC

When user space sets up FunctionFS with only full-speed descriptors (e.g., flags = FUNCTIONFS_HAS_FS_DESC) and the gadget operates at a higher speed (such as USB_SPEED_HIGH or USB_SPEED_SUPER), config_ep_by_speed() detects that the function lacks descriptors for the current speed, logs a warning, and falls back to full-speed descriptors. The endpoint is then successfully enabled via usb_ep_enable(), and epfile->ep becomes valid.

However, when user space subsequently issues the FUNCTIONFS_ENDPOINT_DESC ioctl to query the endpoint descriptor, ffs_epfile_ioctl() selects the descriptor index solely based on gadget->speed:

switch (epfile-&gt;ffs-&gt;gadget-&gt;speed) {
case USB_SPEED_SUPER:
case USB_SPEED_SUPER_PLUS:
    desc_idx = 2;
    break;
case USB_SPEED_HIGH:
    desc_idx = 1;
    break;
default:
    desc_idx = 0;
}
desc = epfile-&gt;ep-&gt;descs[desc_idx];
memcpy(&amp;desc1, desc, desc-&gt;bLength);

Because user space only supplied full-speed descriptors, epfile->ep->descs[1] is NULL. Dereferencing desc->bLength triggers an immediate kernel NULL pointer dereference panic.

Fix this by falling back through lower speed descriptors if the current speed descriptor was not supplied, matching the fallback logic in config_ep_by_speed() and historical f_fs behavior. If still missing, fall back to epfile->ep->ep->desc (the active descriptor), and return -EINVAL safely if no valid descriptor is found. In addition, mark desc as const to match struct usb_ep::desc and avoid discarding qualifiers.

CVSS Base Scores

version 3.1