CVE-2026-90023: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() Previously fsg_num_buffers_validate() was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2. However, setting the page content in such a way that kstrtou8() reflects n value as either 0 or 1 bypasses these restrictions leading to a null pointer dereference if n is 0. Fix this by adding a check for n < 2 and returning -EINVAL if n is either 0 or 1 consistent with Kconfig logic.

Affected products

• Linux Linux: from 4.8, before 6.12.112 (fixed in 6.12.112); from 6.13, before 6.18.52 (fixed in 6.18.52); from 6.19, before 7.2.5 (fixed in 7.2.5)

Published 2026-09-16. Last modified 2026-10-03.