CVE-2026-90023: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-90023 Overview

CVE-2026-90023 is a null pointer dereference vulnerability in the Linux kernel USB gadget subsystem. The flaw resides in the fsg_common_set_num_buffers() function within the f_mass_storage driver. The kernel developers removed the fsg_num_buffers_validate() function under the assumption that Kconfig bounds (2 to 256, default 2) were sufficient to constrain the buffer count. However, crafting sysfs page content so that kstrtou8() parses the value as 0 or 1 bypasses those Kconfig limits. When the value is 0, the driver dereferences a null pointer during buffer allocation.

Critical Impact
Local users with the ability to write buffer count values through sysfs can trigger a kernel null pointer dereference, causing a denial of service on the affected system.

Affected Products

Linux kernel — USB gadget subsystem (drivers/usb/gadget/function/f_mass_storage.c)
Stable kernel branches referenced in the fix commits 2c0f5ca4, 9e8dd2a7, and b9b5b5df
Systems configured with USB gadget mass storage support

Discovery Timeline

2026-09-16 - CVE CVE-2026-90023 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90023

Vulnerability Analysis

The vulnerability exists in the mass storage function driver used by the Linux USB gadget framework. The fsg_common_set_num_buffers() function allocates an array of buffer head structures based on a caller-supplied count. Earlier kernel versions used fsg_num_buffers_validate() to reject values below 2. Maintainers removed that helper because the Kconfig option USB_GADGET_STORAGE_NUM_BUFFERS restricts the compile-time default to the range 2–256.

The removal ignored the runtime write path exposed through sysfs. Writing to the num_buffers attribute reaches kstrtou8(), which accepts any 8-bit unsigned value including 0 and 1. When num_buffers is 0, subsequent allocation logic returns without initializing the buffer head pointer array. Later dereferences of that pointer trigger a kernel oops.

Root Cause

The root cause is missing input validation [CWE-476] on a runtime-configurable parameter. The fix restores an explicit check that returns -EINVAL when the caller supplies a value less than 2, aligning runtime behavior with the Kconfig contract.

Attack Vector

Exploitation requires local access with permission to write the USB gadget configuration attributes exposed under configfs or sysfs. An attacker with the required privilege writes 0 to the num_buffers attribute of a mass storage gadget instance. The subsequent activation of the gadget invokes fsg_common_set_num_buffers(), dereferences the uninitialized pointer, and crashes the kernel.

The vulnerability does not enable code execution or privilege escalation on its own. It is a denial-of-service condition affecting system availability. Refer to the upstream commits for the exact patched code paths: kernel commit 2c0f5ca4, kernel commit 9e8dd2a7, and kernel commit b9b5b5df.

Detection Methods for CVE-2026-90023

Indicators of Compromise

Kernel oops or panic messages referencing fsg_common_set_num_buffers in the call trace
Unexpected writes to USB gadget num_buffers sysfs or configfs attributes with values of 0 or 1
System crashes correlated with USB gadget configuration changes on embedded or containerized Linux hosts

Detection Strategies

Audit kernel logs (dmesg, journalctl -k) for null pointer dereference traces containing f_mass_storage symbols
Monitor process activity that opens or writes to files under /sys/kernel/config/usb_gadget/*/functions/mass_storage.*/
Track loading of the usb_f_mass_storage module on systems that do not require USB gadget functionality

Monitoring Recommendations

Enable Linux audit rules on the configfs mount to record writes to USB gadget attributes
Forward kernel logs to a central data lake and alert on BUG: or Oops: entries referencing gadget subsystem symbols
Baseline which hosts legitimately expose USB gadget configuration and flag deviations

How to Mitigate CVE-2026-90023

Immediate Actions Required

Apply the upstream stable kernel updates that reintroduce the n < 2 validation in fsg_common_set_num_buffers()
Restrict write access to /sys/kernel/config/usb_gadget/ to root-only and remove unnecessary user or container permissions
Unload the usb_f_mass_storage module on systems that do not require USB mass storage gadget functionality

Patch Information

The fix adds an explicit check that returns -EINVAL when the requested buffer count is less than 2, matching the lower bound enforced by Kconfig. The corrected code is available in the upstream stable branches referenced by commits 2c0f5ca4, 9e8dd2a7, and b9b5b5df. Distribution vendors will ship the fix through their standard kernel update channels.

Workarounds

Disable CONFIG_USB_MASS_STORAGE and CONFIG_USB_CONFIGFS_MASS_STORAGE in kernel builds where the functionality is not required
Prevent unprivileged mounting or access to configfs by tightening mount options and container capabilities such as CAP_SYS_ADMIN
Use kernel lockdown mode or seccomp policies to block writes to USB gadget attributes from untrusted workloads

bash

# Configuration example: unload the vulnerable module and blocklist it
sudo modprobe -r usb_f_mass_storage
echo 'blacklist usb_f_mass_storage' | sudo tee /etc/modprobe.d/blacklist-fsg.conf