CVE-2026-90045: Linux Kernel USB Gadget Use-After-Free Vulnerability

CVE-2026-90045 Overview

CVE-2026-90045 is a use-after-free vulnerability in the Linux kernel's USB gadget FunctionFS (FFS) subsystem. The flaw resides in the io_data structure, which stores a pointer to the submitting task's mm_struct without holding a reference while asynchronous requests remain pending. If the submitting task exits before completion handling finishes, the kernel dereferences freed memory. A local attacker with the ability to submit async I/O against an FFS gadget endpoint can trigger memory corruption and potentially escalate privileges.

Critical Impact
Local use-after-free in the USB gadget FFS driver enabling kernel memory corruption, denial of service, and potential local privilege escalation.

Affected Products

Linux kernel — USB gadget FunctionFS (drivers/usb/gadget/function/f_fs.c)
Stable kernel branches receiving the referenced backport commits
Systems exposing FFS gadget endpoints to unprivileged or containerized workloads

Discovery Timeline

2026-09-16 - CVE-2026-90045 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-90045

Vulnerability Analysis

The Linux kernel's USB gadget FunctionFS driver supports asynchronous I/O (AIO) submissions from userspace against gadget endpoints. When a read request is queued, the driver stores the submitter's mm_struct pointer inside the per-request io_data structure so it can later copy data back into the correct address space during completion.

The defect is a lifetime mismatch. The driver never increments the reference count on the referenced mm_struct. If the submitting task exits while the async request is still in flight, the memory descriptor can be torn down before the USB completion handler runs. The completion path then dereferences a stale mm_struct pointer, producing a classic use-after-free condition in kernel memory.

Root Cause

The root cause is missing reference counting on a kernel object shared across asynchronous execution contexts. The FFS AIO submission path captured current->mm without calling mmgrab(), and the completion path did not call mmdrop(). The patch resolves the issue by taking a reference with mmgrab() when the read request is queued and releasing it with mmdrop() on request completion, binding the mm_struct lifetime to the outstanding request rather than to the submitting task.

Attack Vector

Exploitation requires local access and the ability to interact with a FunctionFS gadget endpoint, typically through a userspace daemon that has opened FFS instances or a container with sufficient device access. An attacker submits asynchronous read requests, forces the submitting task to exit before completion, and races the completion handler against mm_struct teardown. Successful exploitation yields kernel-mode memory corruption that can be shaped into arbitrary write primitives and, ultimately, local privilege escalation.

No public proof-of-concept exploit is referenced in the advisory. Refer to the upstream commits for the exact code paths: Kernel Git Commit 5eb5c72, Kernel Git Commit 7411de0, and Kernel Git Commit f3d3148.

Detection Methods for CVE-2026-90045

Indicators of Compromise

Kernel oops or general protection fault messages referencing ffs_epfile_io, ffs_user_copy_worker, or mmput/mmdrop in the call stack.
Unexpected process crashes or panics on hosts running FFS-backed USB gadget daemons such as adbd, mtp-server, or custom ConfigFS gadgets.
KASAN reports flagging a use-after-free on an mm_struct slab allocation originating from FFS AIO completion paths.

Detection Strategies

Enable KASAN and lockdep on test kernels to surface the specific use-after-free during fuzzing of FFS endpoints.
Audit running kernel versions against the fixed commits and flag any host still on a vulnerable stable branch.
Monitor kernel ring buffer (dmesg) and /var/log/kern.log for repeated FFS-related faults, which may indicate exploitation attempts or instability.

Monitoring Recommendations

Inventory hosts and containers with CONFIG_USB_CONFIGFS_F_FS enabled and expose that inventory to your detection pipeline.
Alert on unprivileged processes opening /dev/ffs-* nodes or mounting functionfs filesystems where not expected.
Correlate kernel crash telemetry with process exit events for tasks that recently issued USB gadget AIO submissions.

How to Mitigate CVE-2026-90045

Immediate Actions Required

Apply the upstream fix by updating to a kernel that includes commits 5eb5c72, 7411de0, and f3d3148.
Restrict access to FunctionFS device nodes and configfs gadget interfaces to trusted, privileged processes only.
Disable the USB gadget subsystem on servers and workstations that do not require gadget-mode USB functionality.

Patch Information

The fix takes a reference with mmgrab() when queuing the read request and releases it with mmdrop() on request completion, ensuring the mm_struct outlives any in-flight async request. Distribution-specific backports should be tracked via each vendor's kernel security advisories. Reference commits: Kernel Git Commit 5eb5c72, Kernel Git Commit 7411de0, and Kernel Git Commit f3d3148.

Workarounds

Unload the usb_f_fs module on systems where USB gadget functionality is not required using modprobe -r usb_f_fs.
Blacklist libcomposite and usb_f_fs in /etc/modprobe.d/ to prevent auto-load on affected hosts.
Tighten container runtime policies to block device access to /dev/ffs-* and prevent unprivileged mounts of functionfs.

bash

# Configuration example: prevent FFS gadget module load
echo 'blacklist usb_f_fs' | sudo tee /etc/modprobe.d/blacklist-ffs.conf
echo 'install usb_f_fs /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-ffs.conf
sudo modprobe -r usb_f_fs || true

# Verify the module is not loaded
lsmod | grep -E 'usb_f_fs|libcomposite'