Junglewise Threat Intelligence

CVE-2026-64328: Linux Kernel memory leak in usb gadget f_fs

CVE-2026-64328 · Severity: info · Published 2026-07-25

Technologies: Linux. Vendors: Linux.

Executive brief

A memory leak was identified in the Linux kernel's USB gadget subsystem. This component allows a Linux device to act as a USB peripheral (like a storage drive or network adapter) when connected to another computer. An exploit could cause the system to slowly run out of memory over time, potentially leading to system instability or a crash (denial of service).

Technical details

A memory leak exists in drivers/usb/gadget/function/f_fs.c within the ffs_dmabuf_transfer() function. The vulnerability is caused by an improper reference count management of ffs_dma_fence objects. When a fence is initialized, its kref counter is set to 1, and dma_resv_add_fence() increments it to 2. However, the original reference is never released, causing the object to persist in memory even after being signaled. This results in a gradual consumption of kernel memory. The fix involves calling dma_fence_put() immediately after adding the fence to the reservation object to transfer ownership correctly.

Affected products

  • Linux Linux 6.9 to 6.12.96, 6.18.39, 7.1.4

Timeline

  • 2026-06-09: other: Patch authored
  • 2026-07-25: advisory: CVE published

References