In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12,
the endpoint index is not validated and might be manipulated by the host
for out-of-array access.

It was discovered that the Xilinx USB2 device gadget driver in the Linux
kernel did not properly validate endpoint indices from the host. A
physically proximate attacker could possibly use this to cause a denial of
service (system crash).