CVE-2026-64327: Linux Kernel Privilege Escalation Flaw

CVE-2026-64327 Overview

CVE-2026-64327 is a Linux kernel vulnerability in the USB gadget FunctionFS (f_fs) driver. The flaw involves improper initialization of the epfile->in field that tracks endpoint direction. Before the fix, epfile->in was populated only in ffs_func_eps_enable(), which runs upon USB host connection. Early userspace ioctls such as FUNCTIONFS_DMABUF_ATTACH invoked before host connection observed epfile->in as 0, producing incorrect Direct Memory Access (DMA) directions. The patch moves initialization to ffs_epfiles_create() so the endpoint direction is accurate before userspace opens the endpoint files.

Critical Impact
Incorrect DMA direction assignment during early userspace ioctl operations can cause data corruption or undefined behavior in USB gadget DMA buffer handling.

Affected Products

Linux kernel USB gadget subsystem (drivers/usb/gadget/function/f_fs.c)
Systems using FunctionFS with FUNCTIONFS_DMABUF_ATTACH ioctls
Kernel builds prior to commits referenced in the stable tree fixes

Discovery Timeline

2026-07-25 - CVE-2026-64327 published to the National Vulnerability Database (NVD)
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64327

Vulnerability Analysis

The FunctionFS driver exposes USB gadget endpoints to userspace through per-endpoint files. Each endpoint file is represented by a struct ffs_epfile that tracks direction via the in field. When userspace parses endpoint descriptors, ffs_data_got_descs() builds the eps_addrmap containing endpoint direction information. However, the epfile->in field was populated later, in ffs_func_eps_enable(), which only executes once a USB host establishes a connection.

Userspace applications can issue ioctls against endpoint files before a host connects. The FUNCTIONFS_DMABUF_ATTACH ioctl, used to attach DMA buffer file descriptors for zero-copy transfers, relies on epfile->in to determine the DMA transfer direction. When invoked prior to host connection, the field reads as 0, causing the kernel to assign an incorrect DMA direction to the attached buffer.

Root Cause

The root cause is a delayed field initialization. The endpoint direction was known at descriptor parse time but was not propagated to epfile->in until endpoint enablement. This ordering mismatch between file creation and direction assignment left the field in an uninitialized state during the window when userspace could already interact with the endpoint files.

Attack Vector

The issue requires a local privileged process capable of interacting with FunctionFS endpoint files and issuing ioctls before a USB host connects. Exploitation is confined to local misbehavior of the USB gadget stack rather than remote attack. Incorrect DMA direction assignments can result in data integrity issues, buffer synchronization errors, or downstream kernel warnings. No public exploit is available, and the flaw is not listed on the CISA Known Exploited Vulnerabilities catalog.

The vulnerability class is best categorized as an Uninitialized Memory Use condition affecting kernel driver state.

Detection Methods for CVE-2026-64327

Indicators of Compromise

Kernel log entries referencing DMA direction mismatches or synchronization warnings originating from drivers/usb/gadget/function/f_fs.c
Unexpected FUNCTIONFS_DMABUF_ATTACH ioctl activity prior to USB host enumeration
Userspace processes accessing FunctionFS endpoint files before endpoint enablement events appear in dmesg

Detection Strategies

Audit installed kernel package versions against distribution advisories and cross-reference against the fix commits 82cf1142, 82cfd473, 9e04055a, and f99f32ea
Monitor for processes that open files under FunctionFS mount points and invoke DMA buffer ioctls
Enable kernel tracing on f_fs functions to observe ordering of ffs_epfiles_create() versus ffs_func_eps_enable()

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on repeated USB gadget warnings
Track kernel version drift across Linux fleet inventories to identify systems missing the stable backport
Baseline expected FunctionFS userspace consumers to detect anomalous ioctl usage

How to Mitigate CVE-2026-64327

Immediate Actions Required

Apply the latest stable kernel update containing the fix commits referenced by the upstream stable tree
Rebuild and redeploy custom kernels that include drivers/usb/gadget/function/f_fs.c with the corrected initialization order
Restrict access to FunctionFS mount points to trusted service accounts only

Patch Information

The fix moves initialization of epfile->in from ffs_func_eps_enable() into ffs_epfiles_create() so the direction is set before userspace can open endpoint files. Stable tree backports are available in the following commits: Kernel Git Commit 82cf1142, Kernel Git Commit 82cfd473, Kernel Git Commit 9e04055a, and Kernel Git Commit f99f32ea.

Workarounds

Avoid issuing FUNCTIONFS_DMABUF_ATTACH or similar DMA-related ioctls before a USB host establishes connection to the gadget
Unload or disable the FunctionFS module on systems that do not require USB gadget functionality
Constrain FunctionFS mount permissions so that only vetted userspace daemons can open endpoint files

bash

# Verify running kernel version and check for module usage
uname -r
lsmod | grep -E 'libcomposite|usb_f_fs'

# Unload FunctionFS-related modules if unused (requires no active gadget)
sudo modprobe -r usb_f_fs