CVE-2026-93121 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths
The error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM) in ffs_dmabuf_transfer() jump to err_fence_put which calls dma_fence_put() on the fence. However, at that point the fence has only been kmalloc'd — dma_fence_init() has not been called yet, so the refcount and the fence ops are uninitialized. Calling dma_fence_put() on such an object leads to undefined behavior.
Use kfree() instead, since the fence is just a plain allocation at this stage, and rename the label to err_fence_free to reflect the actual cleanup action.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel vulnerability identified in the USB gadget function filesystem driver involves a critical resource management error within the ffs_dmabuf_transfer() function. This flaw manifests specifically during error handling paths when an endpoint is disabled, resulting in an ESHUTDOWN status, or when request allocation fails due to insufficient memory (ENOMEM). In these scenarios, the code incorrectly attempts to release a dma_fence object that has not been fully initialized. The root cause lies in the sequence of operations where a fence structure is allocated via kmalloc but the subsequent initialization step, specifically dma_fence_init(), which sets up the reference count and function pointers for proper lifecycle management, has not yet executed. Consequently, invoking dma_fence_put() on this partially constructed object triggers undefined behavior because it attempts to dereference uninitialized memory or operate on invalid state data structures that do not conform to the expected kernel object model.
From a technical perspective, this issue represents a classic case of improper resource cleanup where the deallocation method does not match the allocation and initialization state of the object. The dma_fence_put() function is designed to handle reference counting for fully initialized fence objects, often involving complex synchronization primitives and callback invocations defined in the fence operations structure. When called on an object that only exists as a raw memory block allocated by kmalloc, these assumptions are violated. This can lead to kernel panics, data corruption, or other unpredictable system instabilities depending on what garbage values reside in the uninitialized fields of the struct. The vulnerability is classified under CWE-416: Use After Free if the undefined behavior leads to accessing freed memory later, but more accurately it falls under CWE-755: Improper Handling of Exceptional Conditions due to incorrect error path handling and resource management logic errors typical of CWE-252: Unchecked Return Value or CWE-390: Detection of Error Condition Without Action if the failure leads to further cascading issues.
The operational impact of this vulnerability is primarily related to system stability and reliability rather than direct remote code execution, although in severe cases where memory corruption occurs, it could potentially be leveraged for privilege escalation. For systems utilizing USB gadget functionality with DMA buffer transfers, triggering these specific error conditions can cause the kernel to crash or behave erratically. This affects services relying on stable USB device emulation or peripheral connectivity. The lack of proper initialization before cleanup means that any attempt to manage the lifecycle of this fence object prematurely results in undefined behavior, which compromises the integrity of the kernel's memory management subsystem and potentially exposes sensitive information through memory leaks if the allocation is not properly freed via kfree as intended by the fix.
To mitigate this vulnerability, the recommended action is to apply the upstream Linux kernel patch that corrects the error handling logic within ffs_dmabuf_transfer(). The fix involves replacing the call to dma_fence_put() with a direct call to kfree(), ensuring that the raw memory allocation is properly released without attempting to perform complex reference counting operations on an uninitialized object. Additionally, the label for this cleanup path should be renamed from err_fence_put to err_fence_free to accurately reflect the nature of the operation and prevent future confusion among developers maintaining the codebase. System administrators should ensure their kernels are updated with patches addressing this specific issue in the usb gadget subsystem. Monitoring kernel logs for unexpected crashes or warnings related to USB gadget drivers can help identify if systems have not yet been patched against this flaw. Regular security audits focusing on error path handling and resource lifecycle management in kernel modules are essential to prevent similar issues from arising in other parts of the system.