VYPR
High severity7.1NVD Advisory· Published Jul 28, 2025· Updated Jun 17, 2026

CVE-2025-38497

CVE-2025-38497

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: configfs: Fix OOB read on empty string write

When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length 'l' is greater than zero.

This patch fixes the vulnerability by adding a check at the beginning of os_desc_qw_sign_store() and webusb_landingPage_store() to handle the zero-length input case gracefully by returning immediately.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

236

Patches

Vulnerability mechanics

References

10

News mentions

0

No linked articles in our index yet.