Executive brief
A vulnerability was identified in the Linux kernel's USB gadget subsystem, specifically affecting how it handles shared memory buffers (DMABUF). A race condition could allow a local attacker with access to the USB FunctionFS device—typically a system service like a mobile phone's debug bridge or media transfer service—to cause a system crash or potentially execute unauthorized code. This occurs when the system attempts to use memory that has already been freed during certain USB disconnection or detachment events.
Technical details
A use-after-free (UAF) vulnerability exists in drivers/usb/gadget/function/f_fs.c due to improper serialization between DMABUF request completion and cancellation. The function ffs_epfile_dmabuf_io_complete() frees a usb_request but fails to nullify the back-pointer in the private data structure while holding the necessary locks. Consequently, a concurrent FUNCTIONFS_DMABUF_DETACH ioctl or ffs_epfile_release() call can observe the non-NULL stale pointer and pass it to usb_ep_dequeue(), leading to a dereference of freed memory. The fix involves moving the request destruction to a synchronized cleanup handler (ffs_dmabuf_cleanup) and ensuring the pointer is cleared under eps_lock. This is reachable by local privileged or delegated users with access to the FunctionFS device node.
Affected products
- Linux Linux Kernel 7b07a2a7ca02
Timeline
- 2026-04-19: other: Patch submitted by developer
- 2026-07-19: disclosed: CVE published