Vulnerability-Lookup

FKIE_CVE-2026-90044

Vulnerability from fkie_nvd - Published: 2026-09-16 11:17 - Updated: 2026-09-16 15:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix Use-After-Free in AIO error path In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is freed. However, for AIO operations, the kiocb cancel function was already armed and kiocb->private was set to `p`. If a concurrent cancel operation (such as sys_io_cancel()) executes after ffs_epfile_io() fails but before the function frees `p`, a Use-After-Free can occur when the cancellation handler accesses the freed pointer. To securely fix this race condition, we must properly un-arm the cancellation. Invoking `kiocb->ki_complete()` does exactly this by acquiring `ctx->ctx_lock` and safely removing the kiocb from the active sequence. In doing so, it ensures that a parallel io_cancel can no longer discover the kiocb, effectively closing the race window. We then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been consumed and it should avoid attempting to complete the request again or triggering subsequent completion handlers.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/153b5ecd29ed055562400bc17c91df3fd869b0ce
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4a2fb2d12b87b43724230abb52a1440617c7b6cc
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e78dcb1f7ec271449c54984dc90c62a5ba272de7

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "153b5ecd29ed055562400bc17c91df3fd869b0ce",
              "status": "affected",
              "version": "de2080d41b5d584205e408d72021f0f335a046fc",
              "versionType": "git"
            },
            {
              "lessThan": "4a2fb2d12b87b43724230abb52a1440617c7b6cc",
              "status": "affected",
              "version": "de2080d41b5d584205e408d72021f0f335a046fc",
              "versionType": "git"
            },
            {
              "lessThan": "e78dcb1f7ec271449c54984dc90c62a5ba272de7",
              "status": "affected",
              "version": "de2080d41b5d584205e408d72021f0f335a046fc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix Use-After-Free in AIO error path\n\nIn ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io()\nfails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is\nfreed. However, for AIO operations, the kiocb cancel function was already\narmed and kiocb-\u003eprivate was set to `p`.\n\nIf a concurrent cancel operation (such as sys_io_cancel()) executes after\nffs_epfile_io() fails but before the function frees `p`, a Use-After-Free\ncan occur when the cancellation handler accesses the freed pointer.\n\nTo securely fix this race condition, we must properly un-arm the\ncancellation. Invoking `kiocb-\u003eki_complete()` does exactly this by\nacquiring `ctx-\u003ectx_lock` and safely removing the kiocb from the active\nsequence. In doing so, it ensures that a parallel io_cancel can no longer\ndiscover the kiocb, effectively closing the race window.\n\nWe then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been\nconsumed and it should avoid attempting to complete the request again or\ntriggering subsequent completion handlers."
    }
  ],
  "id": "CVE-2026-90044",
  "lastModified": "2026-09-16T15:18:27.100",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-16T11:17:17.660",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/153b5ecd29ed055562400bc17c91df3fd869b0ce"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4a2fb2d12b87b43724230abb52a1440617c7b6cc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e78dcb1f7ec271449c54984dc90c62a5ba272de7"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-90044 (GCVE-0-2026-90044)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:33 – Updated: 2026-09-16 14:41

Title

usb: gadget: f_fs: Fix Use-After-Free in AIO error path

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/153b5ecd29ed05556…
https://git.kernel.org/stable/c/4a2fb2d12b87b4372…
https://git.kernel.org/stable/c/e78dcb1f7ec271449…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: de2080d41b5d584205e408d72021f0f335a046fc , < 153b5ecd29ed055562400bc17c91df3fd869b0ce (git) Affected: de2080d41b5d584205e408d72021f0f335a046fc , < 4a2fb2d12b87b43724230abb52a1440617c7b6cc (git) Affected: de2080d41b5d584205e408d72021f0f335a046fc , < e78dcb1f7ec271449c54984dc90c62a5ba272de7 (git)
Linux	Linux	Affected: 4.0 Unaffected: 0 , < 4.0 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "153b5ecd29ed055562400bc17c91df3fd869b0ce",
              "status": "affected",
              "version": "de2080d41b5d584205e408d72021f0f335a046fc",
              "versionType": "git"
            },
            {
              "lessThan": "4a2fb2d12b87b43724230abb52a1440617c7b6cc",
              "status": "affected",
              "version": "de2080d41b5d584205e408d72021f0f335a046fc",
              "versionType": "git"
            },
            {
              "lessThan": "e78dcb1f7ec271449c54984dc90c62a5ba272de7",
              "status": "affected",
              "version": "de2080d41b5d584205e408d72021f0f335a046fc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix Use-After-Free in AIO error path\n\nIn ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io()\nfails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is\nfreed. However, for AIO operations, the kiocb cancel function was already\narmed and kiocb-\u003eprivate was set to `p`.\n\nIf a concurrent cancel operation (such as sys_io_cancel()) executes after\nffs_epfile_io() fails but before the function frees `p`, a Use-After-Free\ncan occur when the cancellation handler accesses the freed pointer.\n\nTo securely fix this race condition, we must properly un-arm the\ncancellation. Invoking `kiocb-\u003eki_complete()` does exactly this by\nacquiring `ctx-\u003ectx_lock` and safely removing the kiocb from the active\nsequence. In doing so, it ensures that a parallel io_cancel can no longer\ndiscover the kiocb, effectively closing the race window.\n\nWe then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been\nconsumed and it should avoid attempting to complete the request again or\ntriggering subsequent completion handlers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in FunctionFS epfile AIO (`ffs_epfile_write_iter`/`read_iter` via `io_submit`/`io_cancel` on functionfs ep files), a local syscall path. `ffs_epfile_io()` can fail with `-EAGAIN` on `O_NONBLOCK` before any USB host is involved; this is the gadget userspace API, matching CVE-2024-36894/CVE-2026-63894 as Local rather than Physical.\nAC:L - The attacker controls both sides: one thread `io_submit`s AIO that fails after `kiocb_set_cancel_fn` (O_NONBLOCK `-EAGAIN`, halt, `-EFAULT`), while another calls `io_cancel`/`io_destroy`. The race between `kfree(p)` and `aio_remove_iocb` is freely retryable, so a race the attacker creates is AC:L.\nPR:L - FunctionFS mounts commonly use `uid=`/`gid=`/`fmode=` to delegate ep files to unprivileged gadget daemons (adbd/shell on Android, MTP, embedded USB services). Once mounted by init, those accounts can open ep files and issue AIO without init-namespace root.\nUI:N - The attacker performs `io_submit` and `io_cancel`/`io_destroy` on their own FunctionFS endpoint fds. No separate victim action is required beyond an already-deployed FunctionFS gadget.\nS:U - The use-after-free corrupts kernel heap (`ffs_io_data`) within the same host kernel security authority. This is ordinary local privilege escalation, not a VM escape or IOMMU/sandbox boundary cross.\nC:H - Use-after-free of `ffs_io_data`: `ffs_aio_cancel()` reads `kiocb-\u003eprivate` after `kfree`. Reclaim of that kmalloc object lets the attacker control `io_data-\u003eep`/`req` and leak kernel memory via UDC dequeue; UAFs are scored High for confidentiality.\nI:H - A reclaimed `ffs_io_data` yields attacker-controlled pointers passed to `usb_ep_dequeue()` from `ffs_aio_cancel`, providing a heap write and control-flow hijack primitive. Kernel UAFs are scored High for integrity.\nA:H - Dereferencing the freed `ffs_io_data` in `ffs_aio_cancel` causes kernel oops/panic even without a full exploit; any such crash is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:41:58.245Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/153b5ecd29ed055562400bc17c91df3fd869b0ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a2fb2d12b87b43724230abb52a1440617c7b6cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/e78dcb1f7ec271449c54984dc90c62a5ba272de7"
        }
      ],
      "title": "usb: gadget: f_fs: Fix Use-After-Free in AIO error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90044",
    "datePublished": "2026-09-16T10:33:41.695Z",
    "dateReserved": "2026-09-11T19:38:34.783Z",
    "dateUpdated": "2026-09-16T14:41:58.245Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.