Executive brief
A vulnerability was discovered in the Linux kernel's USB FunctionFS subsystem, which is used to implement USB gadgets. A race condition allows a local user to access memory that has already been freed when opening and removing USB endpoint files. This could lead to a system crash or potentially allow an attacker to gain unauthorized access to sensitive information or execute malicious code.
Technical details
A race condition exists in the Linux kernel's FunctionFS (f_fs.c) between ffs_epfile_open() and the removal of dynamic files. The vulnerability stems from the misuse of the ffs->opened counter, where atomic operations (atomic_dec_and_test vs. atomic_add_return) failed to properly synchronize file access during object destruction. If a thread enters ffs_epfile_open() while another thread triggers removal but before the opener increments the reference count, the open operation succeeds with file->private_data pointing to a freed object. This results in a use-after-free (UAF) during subsequent read() or write() operations. The fix involves serializing openers using ffs->mutex, utilizing atomic_inc_not_zero() for dynamic files, and clearing i_private during removal to ensure stale inodes are invalidated.
Affected products
- Linux Linux Kernel 2.6.35 to 6.19-rc8
Timeline
- 2025-11-14: patched: Initial patch authored by Al Viro
- 2026-01-13: disclosed: CVE published