CVE-2026-64328 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Fix DMA fence leak
In ffs_dmabuf_transfer(), a ffs_dma_fence object is kmalloc'd, with the underlying dma_fence later initialized by dma_fence_init(), which sets its kref counter to 1. Then, dma_resv_add_fence() gets a second reference, and a pointer to the ffs_dma_fence is passed as the usb_request's "context" field.
The dma-resv mechanism will manage the second reference, but the first reference is never properly released; the ffs_dmabuf_cleanup() function decreases the reference count, but only to balance with the reference grab in ffs_dmabuf_signal_done().
The code will then slowly leak memory as more ffs_dma_fence objects are created without being ever freed.
Address this issue by transferring ownership of the fence to the DMA reservation object, by calling dma_fence_put() right after dma_resv_add_fence(). The ffs_dma_fence then gets properly discarded after being signalled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability identified in the Linux kernel's usb gadget function filesystem implementation represents a critical memory management flaw that can lead to gradual system resource exhaustion. This issue specifically affects the f_fs driver component responsible for USB gadget functionality, where improper handling of DMA fence objects creates a persistent memory leak. The problem manifests within the ffs_dmabuf_transfer() function which manages data buffer transfers between userspace and kernel space through the function filesystem interface.
The technical root cause stems from inadequate reference counting management in the DMA fence lifecycle. When ffs_dmabuf_transfer() is invoked, it allocates a ffs_dma_fence object using kmalloc(), followed by initialization of the underlying dma_fence through dma_fence_init() which establishes an initial kref counter value of 1. Subsequently, dma_resv_add_fence() creates a second reference to this same fence object while simultaneously storing a pointer to the ffs_dma_fence in the usb_request's context field for later operations. This dual reference management creates a fundamental imbalance where the first reference acquired during allocation is never properly released through the standard reference counting mechanism.
The operational impact of this vulnerability extends beyond simple memory consumption as it represents a classic resource leak pattern that can degrade system performance over time. The ffs_dmabuf_cleanup() function attempts to balance reference counts but only accounts for references obtained through ffs_dmabuf_signal_done(), leaving the original allocation reference unreleased. As the USB gadget functionality continues to process requests, each new ffs_dma_fence object creation generates additional unreleased memory allocations that accumulate over time. This progressive memory consumption can eventually lead to system instability, reduced performance, or even complete system resource exhaustion depending on the workload intensity.
The mitigation strategy addresses this through proper ownership transfer semantics by implementing dma_fence_put() immediately following dma_resv_add_fence(). This ensures that the DMA reservation object assumes full responsibility for managing the fence lifecycle, allowing proper cleanup when the fence is signalled and the object can be safely discarded. This fix aligns with established kernel memory management best practices and prevents the accumulation of unreferenced DMA fence objects. The solution directly addresses the underlying CWE-401 vulnerability category related to improper resource management and memory leaks, while also conforming to ATT&CK technique T1070.004 for indicator removal through proper resource cleanup processes. This remediation approach ensures that all allocated resources are properly accounted for and released according to standard reference counting protocols within the kernel's DMA subsystem.