Executive brief
A deadlock vulnerability exists in the Linux kernel's USB gadget function file system (f_fs) driver that can freeze the system when a userspace daemon reads from the ep0 endpoint while the gadget is being torn down. This prevents normal device teardown and can cause the system to become unresponsive until manual intervention.
Technical details
The vulnerability is a deadlock (synchronization issue) in the ffs_ep0_read() function within the USB gadget f_fs driver. The root cause is that ffs_ep0_read() holds the ffs->mutex lock while calling wait_event_interruptible_exclusive_locked_irq(), which sleeps without releasing the mutex. When gadget teardown via configfs simultaneously attempts to acquire ffs->mutex, and the userspace daemon loops back to issue another read(), a deadlock occurs: the teardown thread blocks on the mutex while the daemon holds it indefinitely in an interruptible sleep with no events coming. The fix drops both the waitqueue spinlock and ffs->mutex before sleeping by switching to wait_event_interruptible_exclusive() and reacquiring the mutex after waking at the retry label. This is a kernel-level synchronization bug affecting the USB gadget subsystem, with no evidence of exploitation in the wild.
Affected products
- Linux Linux kernel (prior to fix)
Timeline
- 2026-09-11: disclosed