CVE-2026-90045 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: ffs: fix mm lifetime handling
io_data stores a pointer to the submitting task's mm_struct, but does not currently hold a reference to it while async requests are pending.
This can result in a use-after-free if the task exits before completion handling finishes.
Take a reference with mmgrab() when queuing the read request and release it with mmdrop() on request completion.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel USB gadget functionFS driver contains a critical memory management flaw related to how process address space structures are handled during asynchronous I/O operations. Specifically, the io_data structure retains a pointer to the mm_struct of the task that submitted an async read or write request. However, under previous implementation logic, this pointer was stored without acquiring a reference count on the underlying memory descriptor object. In Linux kernel architecture, the mm_struct represents the virtual address space and related resources for a process. While pointers to such structures are often used to access user-space buffers during DMA transfers or data copying, they do not inherently prevent the associated task from terminating. Without an explicit reference held by the driver, the kernel's memory management subsystem is free to reclaim and destroy the mm_struct as soon as the submitting task exits, regardless of whether pending asynchronous requests have completed their operations.
This oversight creates a classic use-after-free vulnerability scenario. When a user-space application submits an async request via functionFS, it expects the kernel to process data from or into its memory buffers after the submission returns control to the application. If the application thread terminates before the USB gadget controller finishes processing these pending requests, the mm_struct associated with that task is freed by the kernel's exit path logic. Subsequently, when the completion handler for the async request executes, it attempts to access the now-freed memory region through the stale pointer stored in io_data. This dereference of a dangling pointer leads to undefined behavior, which can manifest as a kernel panic, data corruption, or potentially allow an attacker with local user privileges to execute arbitrary code within the kernel context by exploiting the corrupted state of freed memory structures.
From a threat modeling perspective, this vulnerability aligns with CWE-416, Use After Free, where software continues to use a pointer after it has been freed. The attack vector is primarily Local, requiring an attacker to have access to the system and the ability to invoke USB gadget interfaces or simulate device connections if applicable hardware exists. In terms of MITRE ATT&CK frameworks, this falls under techniques involving exploitation of resource management errors that can lead to privilege escalation or denial of service against critical kernel components. The impact is severe because it compromises the integrity and availability of the operating system core, potentially leading to a complete system crash (DoS) if exploited in certain contexts, though arbitrary code execution remains the primary concern due to the nature of kernel memory corruption.
The resolution involves implementing proper reference counting semantics for the mm_struct during the lifecycle of async requests. The fix mandates calling mmgrab() when queuing the read or write request. This function increments the reference count on the task's memory descriptor, ensuring that the structure remains allocated in memory even if the original process terminates. Correspondingly, mmdrop() is called within the completion handler once the asynchronous operation finishes and the driver no longer needs access to the user-space buffers. This ensures a balanced lifecycle where resources are acquired before use and released only after safe termination of operations. To mitigate this risk on systems that have not yet applied the patch, administrators should ensure timely application of kernel updates for affected distributions. Additionally, restricting USB gadget functionality to trusted users or disabling unnecessary functionFS instances can reduce the attack surface available to potential local attackers seeking to trigger these race conditions.