Look up another CVE · open CVE-2026-90044 in the interactive tracker
CVE-2026-90044
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/usb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90044 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is freed. However, for AIO operations, the kiocb cancel function was already armed and kiocb->private was set to `p`. If a concurrent cancel operation (such as sys_io_cancel()) executes after ffs_epfile_io() fails but before the function frees `p`, a Use-After-Free can occur when the cancellation handler accesses the freed pointer. To securely fix this race condition, we must properly un-arm the cancellation. Invoking `kiocb->ki_complete()` does exactly this by acquiring `ctx->ctx_lock` and safely removing the kiocb from the active sequence. In doing so, it ensures that a parallel io_cancel can no longer discover the kiocb, effectively closing the race window. We then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been consumed and it should avoid attempting to complete the request again or triggering subsequent completion handlers.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/usb/gadget/function/f_fs.c
- What this is
- USB SUBSYSTEMMAINTAINERS section matched on drivers/usb/ · linux-usb@vger.kernel.org · Supported
- Kernel module
- usb_f_fs
Check it on the machine
grep -wE 'CONFIG_OF|CONFIG_PCI|CONFIG_USB|CONFIG_USB_F_FS|CONFIG_USB_GADGET|CONFIG_USB_PHY|CONFIG_USB_SUPPORT' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w usb_f_fsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, i386/686, i386/686-pae, i386/rt/686-pae, ppc64el/powerpc64le
- trixieMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, armel/rpi, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_OF, CONFIG_PCI, CONFIG_USB, CONFIG_USB_F_FS, CONFIG_USB_GADGET, CONFIG_USB_PHY, CONFIG_USB_SUPPORT
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/usb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.0 | 6.12.111 | b5f0e80a03e8 |
| 4.0 | 6.18.51 | 153b5ecd29ed |
| 4.0 | 7.2.5 | 4a2fb2d12b87 |
| 4.0 | 7.3 | e78dcb1f7ec2 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The UAF is in FunctionFS epfile AIO (`ffs_epfile_write_iter`/`read_iter` via `io_submit`/`io_cancel` on functionfs ep files), a local syscall path. `ffs_epfile_io()` can fail with `-EAGAIN` on `O_NONBLOCK` before any USB host is involved; this is the gadget userspace API, matching CVE-2024-36894/CVE-2026-63894 as Local rather than Physical.
- AC:LAttack complexity, low
- The attacker controls both sides: one thread `io_submit`s AIO that fails after `kiocb_set_cancel_fn` (O_NONBLOCK `-EAGAIN`, halt, `-EFAULT`), while another calls `io_cancel`/`io_destroy`. The race between `kfree(p)` and `aio_remove_iocb` is freely retryable, so a race the attacker creates is AC:L.
- PR:LPrivileges required, low
- FunctionFS mounts commonly use `uid=`/`gid=`/`fmode=` to delegate ep files to unprivileged gadget daemons (adbd/shell on Android, MTP, embedded USB services). Once mounted by init, those accounts can open ep files and issue AIO without init-namespace root.
- UI:NUser interaction, none
- The attacker performs `io_submit` and `io_cancel`/`io_destroy` on their own FunctionFS endpoint fds. No separate victim action is required beyond an already-deployed FunctionFS gadget.
- S:UScope, unchanged
- The use-after-free corrupts kernel heap (`ffs_io_data`) within the same host kernel security authority. This is ordinary local privilege escalation, not a VM escape or IOMMU/sandbox boundary cross.
- C:HConfidentiality impact, high
- Use-after-free of `ffs_io_data`: `ffs_aio_cancel()` reads `kiocb->private` after `kfree`. Reclaim of that kmalloc object lets the attacker control `io_data->ep`/`req` and leak kernel memory via UDC dequeue; UAFs are scored High for confidentiality.
- I:HIntegrity impact, high
- A reclaimed `ffs_io_data` yields attacker-controlled pointers passed to `usb_ep_dequeue()` from `ffs_aio_cancel`, providing a heap write and control-flow hijack primitive. Kernel UAFs are scored High for integrity.
- A:HAvailability impact, high
- Dereferencing the freed `ffs_io_data` in `ffs_aio_cancel` causes kernel oops/panic even without a full exploit; any such crash is High availability impact.