Executive brief
A memory leak was identified in the Linux kernel's USB gadget subsystem. This component allows a Linux device to act as a USB peripheral (like a storage drive or network adapter) when connected to another computer. An exploit could cause the system to slowly run out of memory over time, potentially leading to system instability or a crash (denial of service).
Technical details
A memory leak exists in drivers/usb/gadget/function/f_fs.c within the ffs_dmabuf_transfer() function. The vulnerability is caused by an improper reference count management of ffs_dma_fence objects. When a fence is initialized, its kref counter is set to 1, and dma_resv_add_fence() increments it to 2. However, the original reference is never released, causing the object to persist in memory even after being signaled. This results in a gradual consumption of kernel memory. The fix involves calling dma_fence_put() immediately after adding the fence to the reservation object to transfer ownership correctly.
Affected products
- Linux Linux 6.9 to 6.12.96, 6.18.39, 7.1.4
Timeline
- 2026-06-09: other: Patch authored
- 2026-07-25: advisory: CVE published