Executive brief
The Linux kernel's USB gadget function file system (f_fs) contains a use-after-free vulnerability in asynchronous I/O (AIO) error handling. An attacker with local access could trigger a race condition between error cleanup and concurrent cancellation operations, potentially leading to kernel memory corruption, system crash, or privilege escalation.
Technical details
The vulnerability exists in ffs_epfile_write_iter() and ffs_epfile_read_iter() functions within drivers/usb/gadget/function/f_fs.c. When ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure is freed while the AIO kiocb cancellation handler remains armed with a reference to that freed memory. A concurrent sys_io_cancel() call can exploit this race window to access the freed pointer, causing a use-after-free condition. The fix involves invoking kiocb->ki_complete() before freeing the io_data structure, which acquires the necessary locks and removes the kiocb from the active queue, closing the race window. The patch was committed upstream on 2026-09-04 and requires local attack preconditions (ability to initiate USB gadget AIO operations).
Affected products
- Linux Linux kernel Affected versions prior to patch commit e78dcb1f7ec271449c54984dc90c62a5ba272de7
Timeline
- 2026-09-16: disclosed: Vulnerability published on NVD
- 2026-09-04: patched: Upstream patch commit e78dcb1f7ec271449c54984dc90c62a5ba272de7
- 2026-09-11: patched: Merged into Linux stable tree