gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.
4.4.0-185.2154.4.0-1110.1214.15.0-1074.78~16.04.14.15.0-1091.101~16.04.14.15.0-1078.88~16.04.14.15.0-107.108~16.04.14.10.0-14.16~16.04.14.10.0-19.21~16.04.14.10.0-20.22~16.04.14.10.0-21.23~16.04.14.10.0-22.24~16.04.14.10.0-24.28~16.04.14.10.0-26.30~16.04.14.11.0-13.19~16.04.14.11.0-14.20~16.04.14.13.0-16.19~16.04.3+13 more4.4.0-1076.834.15.0-1046.50~16.04.14.4.0-1135.144Exploitability
AV:NAC:LPR:NUI:RScope
S:UImpact
C:NI:NA:HCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H