CVE-2026-90044: Linux Kernel USB Gadget Use-After-Free

CVE-2026-90044 Overview

CVE-2026-90044 is a Use-After-Free vulnerability in the Linux kernel's USB gadget FunctionFS (f_fs) driver. The flaw resides in the asynchronous I/O (AIO) error path of ffs_epfile_write_iter() and ffs_epfile_read_iter(). When ffs_epfile_io() returns any error other than -EIOCBQUEUED, the driver frees the io_data structure while the kiocb cancel handler remains armed with kiocb->private pointing to that same structure. A concurrent sys_io_cancel() call can then dereference the freed pointer, producing a race window suitable for local exploitation.

Critical Impact
A local unprivileged user with access to a FunctionFS endpoint can trigger kernel memory corruption, potentially leading to privilege escalation or denial of service.

Affected Products

Linux kernel versions containing the vulnerable drivers/usb/gadget/function/f_fs.c AIO code path
Systems exposing USB gadget FunctionFS endpoints to unprivileged users
Distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-09-16 - CVE-2026-90044 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90044

Vulnerability Analysis

The vulnerability is a Use-After-Free [CWE-416] combined with a race condition [CWE-362] in the Linux kernel USB gadget FunctionFS driver. FunctionFS exposes USB endpoints to userspace via a filesystem interface, allowing user applications to implement USB device functionality. The driver supports asynchronous I/O through the kernel AIO subsystem, which requires cooperation between the submission path and the cancellation path.

During an AIO submission, the driver allocates an io_data structure (p), arms kiocb->ki_cancel with a cancellation handler, and stores p in kiocb->private. If the subsequent call to ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the submission path frees p before returning. The cancellation handler, however, remains reachable from any concurrent io_cancel(2) syscall. If that syscall runs after ffs_epfile_io() fails but before the freed pointer is unlinked, the handler dereferences freed kernel memory.

Root Cause

The root cause is missing synchronization between the AIO error path and the kiocb cancellation mechanism. The submission path frees the io_data structure without first un-arming the cancel handler or removing the kiocb from the AIO context's active list. Cancellation is serialized by ctx->ctx_lock, but the error path does not acquire that lock before freeing memory referenced by kiocb->private.

The fix invokes kiocb->ki_complete() on failure, which acquires ctx->ctx_lock, safely removes the kiocb from the active sequence, and prevents any concurrent io_cancel from discovering the kiocb. The function then returns -EIOCBQUEUED so the VFS layer does not attempt to complete the request a second time.

Attack Vector

Exploitation requires local access and permission to open a FunctionFS endpoint file, typically granted to processes managing USB gadget functions. An attacker submits AIO read or write operations designed to trigger the failure path in ffs_epfile_io() and races them against sys_io_cancel() calls targeting the same kiocb. Winning the race causes the cancellation handler to operate on freed kernel memory, which an attacker can groom to achieve controlled memory corruption. Reference commits are available at kernel.org 153b5ecd, kernel.org 4a2fb2d1, and kernel.org e78dcb1f.

// No verified proof-of-concept code is available for this CVE.
// See the referenced kernel.org commits for the authoritative patch diff.

Detection Methods for CVE-2026-90044

Indicators of Compromise

Kernel oops or panic messages referencing ffs_epfile_io, ffs_epfile_read_iter, ffs_epfile_write_iter, or the AIO cancel path in dmesg.
KASAN Use-After-Free reports in kernel logs pointing to io_data allocations within f_fs.c.
Unexpected process crashes or system instability on hosts exposing USB gadget FunctionFS interfaces.

Detection Strategies

Audit running kernel versions against the fixed commits referenced in the kernel.org advisories to identify unpatched hosts.
Enable KASAN and LOCKDEP on test kernels to surface Use-After-Free and race conditions during QA of FunctionFS workloads.
Monitor for unprivileged processes invoking io_submit(2) and io_cancel(2) against files under functionfs mount points.

Monitoring Recommendations

Collect dmesg, journalctl -k, and crash dumps centrally so kernel oops signatures can be correlated across fleets.
Track processes that open descriptors under FunctionFS mount points and alert on unexpected callers.
Baseline USB gadget usage on servers and embedded devices; investigate hosts where FunctionFS activity appears without a business justification.

How to Mitigate CVE-2026-90044

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 153b5ecd29ed, 4a2fb2d12b87, and e78dcb1f7ec2 and reboot affected systems.
On systems that do not require USB gadget functionality, unload the g_ffs and libcomposite modules and blacklist them.
Restrict access to FunctionFS mount points so only trusted service accounts can submit AIO operations.

Patch Information

The fix invokes kiocb->ki_complete() in the AIO error path of ffs_epfile_write_iter() and ffs_epfile_read_iter() so that ctx->ctx_lock is acquired and the kiocb is removed from the active list before io_data is freed. The function then returns -EIOCBQUEUED to prevent double completion by the VFS layer. Distribution kernels should pick up the changes from kernel.org commit 153b5ecd, kernel.org commit 4a2fb2d1, and kernel.org commit e78dcb1f.

Workarounds

Disable USB gadget mode on systems where it is not required by removing configfs gadget configurations and unloading g_ffs.
Tighten filesystem permissions on FunctionFS mounts so only privileged gadget daemons can open endpoint files.
Where feasible, deploy a kernel built with KASAN in non-production environments to catch exploitation attempts during validation.

bash

# Configuration example: disable and blacklist FunctionFS gadget modules
sudo modprobe -r g_ffs usb_f_fs libcomposite 2>/dev/null
echo 'blacklist g_ffs' | sudo tee /etc/modprobe.d/blacklist-ffs.conf
echo 'blacklist usb_f_fs' | sudo tee -a /etc/modprobe.d/blacklist-ffs.conf
sudo update-initramfs -u