CVE-2026-80854 Overview
CVE-2026-80854 is a use-after-free race condition in the Linux kernel's USB gadget target-core module (f_tcm). The flaw resides in the tcm_usbg_drop_nexus() and usbg_port_unlink() code paths, where the port reference count (tpg_port_count) is decremented too early in the fabric_pre_unlink() callback. This allows session teardown to proceed while active se_lun references still exist, freeing sess_cmd_map while in-flight usbg_cmd work items reference it. The upstream fix introduces an optional fabric_post_unlink() callback that defers the port count decrement until core_dev_del_lun() finishes draining LUN references.
Critical Impact
Concurrent removal of the last LUN and nexus can trigger a kernel use-after-free, producing a DEBUG_OBJECTS "free active" warning followed by a target-core BUG/Oops and potential system crash.
Affected Products
- Linux kernel USB gadget subsystem (drivers/usb/gadget/function/f_tcm.c)
- Linux kernel target-core fabric infrastructure
- Systems configured as USB SCSI target gadgets using TCM
Discovery Timeline
- 2026-09-04 - CVE-2026-80854 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80854
Vulnerability Analysis
The defect is a lifetime-management race in the Linux kernel USB gadget f_tcm target driver. The function tcm_usbg_drop_nexus() allows session removal to proceed once tpg_port_count reaches zero. However, usbg_port_unlink() decrements that counter from the fabric_pre_unlink() callback, which runs before core_dev_del_lun() waits for outstanding se_lun references to drain.
When the removal of the last LUN races with a nexus removal, the nexus path can observe a zero port count and invoke target_remove_session(). This frees sess_cmd_map while an in-flight struct usbg_cmd, including its embedded work item usbg_cmd_work, is still reachable and may execute. The resulting access to freed memory is a classic use-after-free [CWE-416] with race-condition characteristics [CWE-362].
EPSS data lists the exploitation probability at 0.182% (7.91 percentile), reflecting the narrow race window and the requirement for local privileged operations against a configured USB target.
Root Cause
The target-core generic unlink path exposes only a fabric_pre_unlink() callback and no post-unlink hook after core_dev_del_lun() completes. The f_tcm driver used the pre-unlink callback to decrement tpg_port_count, breaking the invariant that the port count must remain nonzero while any LUN references are still draining. Session teardown therefore observed a stale zero count and freed shared session state prematurely.
Attack Vector
Triggering the flaw requires local access with privileges to manage the USB gadget configfs hierarchy and drive concurrent removal of the last LUN and the associated nexus. An attacker with those capabilities can race the two teardown paths to free sess_cmd_map while a command work item is still queued. The result is kernel memory corruption manifesting as a DEBUG_OBJECTS warning, an Oops, or exploitable use-after-free conditions in the target-core command completion path.
No verified proof-of-concept code is published. The upstream commit description characterizes the issue as reproducible by overlapping the last-LUN unlink with nexus removal. See the Kernel Patch c39d0916 for the authoritative fix implementation.
Detection Methods for CVE-2026-80854
Indicators of Compromise
- Kernel log entries containing ODEBUG: free active warnings referencing usbg_cmd_work or the target-core workqueue.
- Kernel Oops or BUG messages originating in drivers/target/target_core_transport.c or drivers/usb/gadget/function/f_tcm.c.
- Unexpected crashes correlated with USB gadget configfs operations that unlink LUNs and drop TPG nexuses.
Detection Strategies
- Enable CONFIG_DEBUG_OBJECTS and CONFIG_SLUB_DEBUG on test kernels to surface use-after-free events during target teardown.
- Audit systems for configured USB SCSI target gadgets (usb_gadget + tcm fabric) and inventory kernel versions against fixed stable releases.
- Correlate kernel crash telemetry with configfs write operations affecting tpg, lun, and nexus paths.
Monitoring Recommendations
- Ingest dmesg and kern.log into centralized logging and alert on ODEBUG, BUG:, and Oops: strings tied to target-core symbols.
- Monitor uptime and unplanned reboots on Linux hosts exporting USB SCSI targets, which are commonly embedded devices or lab systems.
- Track kernel package versions across the fleet to identify hosts running vulnerable revisions predating the stable-tree backports.
How to Mitigate CVE-2026-80854
Immediate Actions Required
- Apply the upstream Linux kernel fix or the corresponding stable-tree backport for your distribution.
- Restrict access to USB gadget configfs (/sys/kernel/config/usb_gadget/ and /sys/kernel/config/target/) to trusted administrators only.
- On systems that do not require USB SCSI target functionality, unload or disable the tcm_usb_gadget module.
Patch Information
The fix adds an optional fabric_post_unlink() callback to target-core and moves the tpg_port_count decrement into it, ensuring the port count stays nonzero until core_dev_del_lun() finishes draining active LUN references. Backports are available across multiple stable branches. Reference commits: Kernel Patch 178f59a0, Kernel Patch 2efbfd42, Kernel Patch 85aa61fe, Kernel Patch ad6f0375, Kernel Patch bbd6aa31, Kernel Patch c1f359d9, Kernel Patch c39d0916, Kernel Patch c494c556, Kernel Patch eaa96a84.
Workarounds
- Blacklist the tcm_usb_gadget module on hosts that do not export SCSI targets over USB.
- Avoid concurrent administrative operations that simultaneously unlink LUNs and drop TPG nexuses on unpatched kernels.
- Enforce strict permissions on target and gadget configfs mount points to reduce local attack surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
