Executive brief
The Linux kernel's USB gadget function filesystem (FFS) driver handles asynchronous I/O requests for USB device communication. A flaw in memory lifetime management can cause the kernel to access freed memory if a user process exits before an asynchronous USB read/write operation completes, potentially leading to system instability, data corruption, or privilege escalation.
Technical details
The vulnerability is a use-after-free (CWE-416) in the USB FFS gadget driver (drivers/usb/gadget/function/f_fs.c). The io_data structure stores a pointer to a user task's mm_struct (memory management context) but does not hold a reference to it while asynchronous requests are pending. If the originating task exits before the async I/O completion handler runs, the mm_struct can be freed while the completion handler still holds a dangling pointer, leading to use-after-free when attempting to access it via kthread_use_mm(). The fix adds mmgrab() to increment the mm_struct reference count when queuing async requests and mmdrop() to decrement it on completion, along with a mmget_not_zero() check to safely detect if the mm has already been freed. Attack requires local access and the ability to submit async I/O to a USB gadget endpoint, then exit the process before completion.
Affected products
- Linux Linux kernel multiple versions (patched in mainline and stable trees)
Timeline
- 2026-09-16: disclosed
- 2026-06-01: patched: Fix committed upstream as 5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8
- 2026-09-04: other: Reported by Gabriel Prostitis