CVE-2026-64594 Overview
CVE-2026-64594 is a Linux kernel vulnerability in the USB gadget FunctionFS (f_fs) driver. The flaw involves an uninitialized work_struct that triggers a kernel warning when a FunctionFS instance is unmounted. The ffs_fs_kill_sb() function unconditionally calls cancel_work_sync() on ffs->reset_work, but this work struct is only initialized on the FFS_DEACTIVATED code path. In the common mount/unmount case, the work struct remains zero-initialized, causing the WARN_ON(!work->func) guard in __flush_work() to fire during umount operations.
Critical Impact
Local users mounting and unmounting FunctionFS instances trigger a kernel warning, producing log noise and potential stability concerns on affected systems.
Affected Products
- Linux kernel (upstream stable branches)
- Systems using USB gadget FunctionFS (usb_f_fs module)
- Distributions shipping unpatched kernels with the f_fs driver enabled
Discovery Timeline
- 2026-08-06 - CVE-2026-64594 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-64594
Vulnerability Analysis
The vulnerability resides in the Linux kernel's USB gadget FunctionFS implementation. When a FunctionFS instance is unmounted, ffs_fs_kill_sb() calls ffs_data_reset(ffs) followed by cancel_work_sync(&ffs->reset_work). This sequence assumes reset_work is always initialized.
The reset_work field is only initialized via INIT_WORK() inside ffs_func_set_alt() and ffs_func_disable(), and only along the FFS_DEACTIVATED path. That state is only reachable through ffs_data_closed() when the instance is mounted with the no_disconnect option.
For typical mounts that never enter the deactivated state, reset_work.func remains NULL. When cancel_work_sync() executes on this uninitialized work, it triggers the WARN_ON(!work->func) guard inside __flush_work() at kernel/workqueue.c:4301, producing a kernel warning during umount.
Root Cause
The root cause is missing initialization of ffs->reset_work in ffs_data_new(). The allocation uses kzalloc_obj(), leaving the work struct zeroed. Neither ffs_data_reset() nor ffs_data_clear() initialize this field. Older kernels silently tolerated cancel_work_sync() on zero-initialized work structs, masking the missing initialization until stricter guard checks were added.
Attack Vector
Exploitation requires local access to mount and unmount a FunctionFS instance. An unprivileged user with mount capability for functionfs can trigger the warning on each unmount. The impact is limited to kernel log warnings and does not directly yield code execution or privilege escalation. See the kernel commit fix for the corrective patch.
The corrective patch moves the INIT_WORK() call into ffs_data_new() so reset_work is valid for the entire lifetime of the ffs_data structure. The redundant INIT_WORK() calls in the two deactivation paths are removed.
Detection Methods for CVE-2026-64594
Indicators of Compromise
- Kernel warning messages referencing __flush_work+0x330/0x360 during umount operations
- Call trace entries showing cancel_work_sync invoked from ffs_fs_kill_sb [usb_f_fs]
- Repeated WARNING: kernel/workqueue.c:4301 entries in dmesg or journalctl -k output
Detection Strategies
- Monitor kernel ring buffer output for WARN_ON traces originating in ffs_fs_kill_sb
- Audit running kernel versions against patched stable branches referenced in the kernel.org commits
- Track loaded modules for the presence of usb_f_fs on systems exposing USB gadget functionality
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on workqueue.c warning signatures
- Include kernel version inventory in configuration management to identify unpatched hosts
- Review USB gadget usage on embedded and mobile-adjacent Linux systems where FunctionFS is commonly enabled
How to Mitigate CVE-2026-64594
Immediate Actions Required
- Apply the upstream kernel patch that initializes reset_work in ffs_data_new()
- Update to a Linux stable kernel release containing the fix referenced in the kernel.org commit tree
- Unload the usb_f_fs module on systems that do not require USB gadget functionality
Patch Information
The fix is available across multiple stable branches. Relevant commits include 0de6ebbabfbb, 3137b243c939, 69faa3779250, 7fe895e0a965, ba1867999dbc, c36393b0d14e, cb19e54ebe9b, and d5631081be07. Distribution kernels should pick up the fix through backports.
Workarounds
- Restrict mount permissions for functionfs on multi-user systems to trusted administrators
- Blacklist the usb_f_fs module on hosts that do not require USB gadget capabilities
- Avoid mounting FunctionFS with the no_disconnect option until patched kernels are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
