Executive brief
A vulnerability in the Linux kernel's USB gadget driver could allow local userspace applications to trigger incorrect memory access directions during USB data transfers. This occurs because the system incorrectly identifies the data flow direction if certain commands are issued before a USB host is fully connected. While primarily a functional bug, it can lead to data corruption or unexpected behavior in devices using the FunctionFS interface.
Technical details
A race condition or initialization logic error exists in drivers/usb/gadget/function/f_fs.c where the endpoint direction (epfile->in) is not populated until a USB host connects. Local userspace processes invoking ioctls such as FUNCTIONFS_DMABUF_ATTACH before connection see a default value of 0, potentially leading to incorrect DMA directions. The fix moves the initialization of the endpoint direction to ffs_epfiles_create() to ensure accuracy before userspace can open the endpoint files. This affects Linux kernels from version 6.9 onwards until patched in stable releases 6.12.96, 6.18.39, and 7.1.4.
Affected products
- Linux Linux 6.9 through 6.12.95, 6.18.38, 7.1.3
Timeline
- 2026-06-19: other: Patch submitted by developer
- 2026-07-25: advisory: CVE published