CVE-2026-90045: USB: gadget: ffs: fix mm lifetime handling
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: ffs: fix mm lifetime handling
iodata stores a pointer to the submitting task's mmstruct, but does not currently hold a reference to it while async requests are pending.
This can result in a use-after-free if the task exits before completion handling finishes.
Take a reference with mmgrab() when queuing the read request and release it with mmdrop() on request completion.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
An asynchronous FunctionFS read request must be pending, and the task that submitted the request must exit before request-completion handling finishes. The vulnerable path occurs because the pending request retains a pointer to the submitting task's mm_struct without holding a reference.
Which systems are exposed?
Systems using the Linux kernel's USB gadget FunctionFS (ffs) functionality are relevant. The provided information does not identify affected kernel versions, distributions, or whether FunctionFS is enabled or used by default.
What can be done if the fix cannot be deployed immediately?
The provided data does not specify a workaround. Exposure is tied to asynchronous FunctionFS read requests and submitting tasks exiting before completion, so environments not using that functionality are not described as reaching the vulnerable condition.
How does the fix prevent the issue?
The fix takes an mm_struct reference with mmgrab() when the read request is queued and releases it with mmdrop() when the request completes. This keeps the submitting task's memory-management structure alive until completion handling is finished.