Look up another CVE · open CVE-2026-90045 in the interactive tracker
CVE-2026-90045
USB: gadget: ffs: fix mm lifetime handling
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/usb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90045 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
io_data stores a pointer to the submitting task's mm_struct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task exits before completion handling finishes. Take a reference with mmgrab() when queuing the read request and release it with mmdrop() on request completion.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/usb/gadget/function/f_fs.c
- What this is
- USB SUBSYSTEMMAINTAINERS section matched on drivers/usb/ · linux-usb@vger.kernel.org · Supported
- Kernel module
- usb_f_fs
Check it on the machine
grep -wE 'CONFIG_OF|CONFIG_PCI|CONFIG_USB|CONFIG_USB_F_FS|CONFIG_USB_GADGET|CONFIG_USB_PHY|CONFIG_USB_SUPPORT' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w usb_f_fsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, i386/686, i386/686-pae, i386/rt/686-pae, ppc64el/powerpc64le
- trixieMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, armel/rpi, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_OF, CONFIG_PCI, CONFIG_USB, CONFIG_USB_F_FS, CONFIG_USB_GADGET, CONFIG_USB_PHY, CONFIG_USB_SUPPORT
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/usb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.15 | 6.12.111 | 1625827648f4 |
| 3.15 | 6.18.51 | f3d31484b3f2 |
| 3.15 | 7.2.5 | 7411de0ce3b4 |
| 3.15 | 7.3 | 5eb5c72c72fe |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The UAF is reached via local aio_read/io_submit on FunctionFS ep files (ffs_epfile_read_iter → ffs_epfile_io), not by parsing USB host packets. This is the gadget userspace API; prior f_fs AIO UAFs (CVE-2024-36894, CVE-2025-71074) are scored Local, which is also the higher-severity vector versus Physical.
- AC:LAttack complexity, low
- The attacker submits the AIO read, can complete it locally (dummy_hcd or an already-bound gadget) and exit while the ordered io_completion_wq worker is still pending. Both sides of the mm-lifetime race are attacker-driven and freely retryable, so this is not AC:H.
- PR:LPrivileges required, low
- ffs_epfile_open has no capability check. FunctionFS mounts commonly set uid=/gid=/fmode= so unprivileged gadget daemons (adbd/shell, MTP) can open ep files; mounting needs init-namespace CAP_SYS_ADMIN, but using already-mounted endpoints does not.
- UI:NUser interaction, none
- The attacker performs io_submit and process exit itself. No separate victim action is required beyond an already-deployed FunctionFS gadget.
- S:UScope, unchanged
- The mm_struct use-after-free corrupts host kernel state within the same security authority. This is standard local kernel privilege escalation, not a VM, IOMMU, or sandbox escape.
- C:HConfidentiality impact, high
- Use-after-free of mm_struct lets kthread_use_mm/switch_mm consume a reclaimed mm (including mm->pgd) and copy_to_iter through attacker-influenced page tables, yielding an arbitrary read primitive. Per scoring guidance, UAF is Confidentiality High.
- I:HIntegrity impact, high
- kthread_use_mm on a sprayed mm_struct can install attacker-controlled page tables, and ffs_copy_to_iter then writes the USB payload through them, giving an arbitrary write and control-flow hijack primitive. Per scoring guidance, UAF is Integrity High.
- A:HAvailability impact, high
- Using a freed mm_struct in kthread_use_mm/switch_mm and copy_to_iter reliably oopses or panics the kernel even without a full exploit, so availability impact is High.