Security Advisory
CVE-2025-38497
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Fix OOB read on empty string write When writing an empty string to either qw_sign or landingPage sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length l is greater than zero. This patch fixes the vulnerability by adding a check at the beginning of os_desc_qw_sign_store() and webusb_landingPage_store() to handle the zero-length input case gracefully by returning immediately.