UBUNTU-CVE-2026-93121: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix fence cleanup in ffsdmabuftransfer() error paths The error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM) in ffsdmabuftransfer() jump to errfenceput which calls dmafenceput() on the fence. However, at that point the fence has only been kmalloc'd — dmafenceinit() has not been called yet, so the refcount and the fence ops are uninitialized. Calling dmafenceput() on such an object leads to undefined behavior. Use kfree() instead, since the fence is just a plain allocation at this stage, and rename the label to errfencefree to reflect the actual cleanup action.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ffs_dmabuf_transfer() error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM), replace dma_fence_put() with kfree() for the uninitialized fence allocation, and rename the err_fence_put label to err_fence_free.
Event History
Frequently Asked Questions
What conditions are required to reach the vulnerable cleanup paths?
The issue is in ffs_dmabuf_transfer() and is reached when an endpoint is disabled, producing ESHUTDOWN, or when request allocation fails with ENOMEM. Exploitation also requires local access, low privileges, and high attack complexity according to the supplied vector.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What is the relevant temporary mitigation if an update cannot be applied?
No temporary mitigation is provided in the supplied data. The described fix changes the affected pre-initialization error paths to free the allocation with kfree() rather than calling dma_fence_put().