FKIE_CVE-2026-90044

Vulnerability from fkie_nvd - Published: 2026-09-16 11:17 - Updated: 2026-09-28 23:10
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix Use-After-Free in AIO error path In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is freed. However, for AIO operations, the kiocb cancel function was already armed and kiocb->private was set to `p`. If a concurrent cancel operation (such as sys_io_cancel()) executes after ffs_epfile_io() fails but before the function frees `p`, a Use-After-Free can occur when the cancellation handler accesses the freed pointer. To securely fix this race condition, we must properly un-arm the cancellation. Invoking `kiocb->ki_complete()` does exactly this by acquiring `ctx->ctx_lock` and safely removing the kiocb from the active sequence. In doing so, it ensures that a parallel io_cancel can no longer discover the kiocb, effectively closing the race window. We then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been consumed and it should avoid attempting to complete the request again or triggering subsequent completion handlers.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/153b5ecd29ed055562400bc17c91df3fd869b0ce
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4a2fb2d12b87b43724230abb52a1440617c7b6cc
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b5f0e80a03e87bd932487e03248eae3ba3ed7b45
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e78dcb1f7ec271449c54984dc90c62a5ba272de7
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5f0e80a03e87bd932487e03248eae3ba3ed7b45",
              "status": "affected",
              "version": "de2080d41b5d584205e408d72021f0f335a046fc",
              "versionType": "git"
            },
            {
              "lessThan": "153b5ecd29ed055562400bc17c91df3fd869b0ce",
              "status": "affected",
              "version": "de2080d41b5d584205e408d72021f0f335a046fc",
              "versionType": "git"
            },
            {
              "lessThan": "4a2fb2d12b87b43724230abb52a1440617c7b6cc",
              "status": "affected",
              "version": "de2080d41b5d584205e408d72021f0f335a046fc",
              "versionType": "git"
            },
            {
              "lessThan": "e78dcb1f7ec271449c54984dc90c62a5ba272de7",
              "status": "affected",
              "version": "de2080d41b5d584205e408d72021f0f335a046fc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix Use-After-Free in AIO error path\n\nIn ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io()\nfails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is\nfreed. However, for AIO operations, the kiocb cancel function was already\narmed and kiocb-\u003eprivate was set to `p`.\n\nIf a concurrent cancel operation (such as sys_io_cancel()) executes after\nffs_epfile_io() fails but before the function frees `p`, a Use-After-Free\ncan occur when the cancellation handler accesses the freed pointer.\n\nTo securely fix this race condition, we must properly un-arm the\ncancellation. Invoking `kiocb-\u003eki_complete()` does exactly this by\nacquiring `ctx-\u003ectx_lock` and safely removing the kiocb from the active\nsequence. In doing so, it ensures that a parallel io_cancel can no longer\ndiscover the kiocb, effectively closing the race window.\n\nWe then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been\nconsumed and it should avoid attempting to complete the request again or\ntriggering subsequent completion handlers."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_fs: Correcci\u00f3n de Uso despu\u00e9s de liberaci\u00f3n en la ruta de error de AIO\n\nEn ffs_epfile_write_iter() y ffs_epfile_read_iter(), cuando ffs_epfile_io() falla con un error distinto de -EIOCBQUEUED, la estructura io_data (\u0027p\u0027) es liberada. Sin embargo, para operaciones AIO, la funci\u00f3n de cancelaci\u00f3n de kiocb ya estaba armada y kiocb -\u003e private se hab\u00eda establecido en \u0027p\u0027.\n\nSi una operaci\u00f3n de cancelaci\u00f3n concurrente (como sys_io_cancel()) se ejecuta despu\u00e9s de que ffs_epfile_io() falla pero antes de que la funci\u00f3n libere \u0027p\u0027, puede ocurrir un Uso despu\u00e9s de liberaci\u00f3n cuando el gestor de cancelaci\u00f3n accede al puntero liberado.\n\nPara corregir de forma segura esta condici\u00f3n de carrera, debemos desarmar correctamente la cancelaci\u00f3n. Invocar \u0027kiocb -\u003e ki_complete()\u0027 hace exactamente esto al adquirir \u0027ctx -\u003e ctx_lock\u0027 y eliminar de forma segura el kiocb de la secuencia activa. Al hacerlo, asegura que un io_cancel paralelo ya no pueda descubrir el kiocb, cerrando eficazmente la ventana de carrera.\n\nLuego devolvemos -EIOCBQUEUED para notificar a la capa VFS que el kiocb ha sido consumido y que debe evitar intentar completar la solicitud de nuevo o activar gestores de finalizaci\u00f3n posteriores."
    }
  ],
  "id": "CVE-2026-90044",
  "lastModified": "2026-09-28T23:10:00.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-16T11:17:17.660",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/153b5ecd29ed055562400bc17c91df3fd869b0ce"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4a2fb2d12b87b43724230abb52a1440617c7b6cc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b5f0e80a03e87bd932487e03248eae3ba3ed7b45"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e78dcb1f7ec271449c54984dc90c62a5ba272de7"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.