UBUNTU-CVE-2026-90044: Use After Free
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix Use-After-Free in AIO error path In ffsepfilewriteiter() and ffsepfilereaditer(), when ffsepfileio() fails with an error other than -EIOCBQUEUED, the iodata structure (p) is freed. However, for AIO operations, the kiocb cancel function was already armed and kiocb->private was set to p. If a concurrent cancel operation (such as sysiocancel()) executes after ffsepfileio() fails but before the function frees p, a Use-After-Free can occur when the cancellation handler accesses the freed pointer. To securely fix this race condition, we must properly un-arm the cancellation. Invoking kiocb->kicomplete() does exactly this by acquiring ctx->ctxlock and safely removing the kiocb from the active sequence. In doing so, it ensures that a parallel iocancel can no longer discover the kiocb, effectively closing the race window. We then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been consumed and it should avoid attempting to complete the request again or triggering subsequent completion handlers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, properly un-arm the AIO cancellation; invoke kiocb->ki_complete() to safely remove the kiocb from the active sequence, then return -EIOCBQUEUED so the VFS does not complete the request again.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are in scope?
The affected software list includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, and the AWS, Azure, and GCP FIPS kernel variants. The provided data does not identify affected or fixed package versions.
What conditions are required to trigger the race?
An attacker needs local access with low privileges and must be able to exercise asynchronous I/O through the USB gadget FunctionFS paths. The race occurs when an I/O operation fails on a non--EIOCBQUEUED error path while a concurrent cancellation operation, such as sys_io_cancel(), accesses the same request.