CVE-2026-90044

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90044", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.783Z", "datePublished": "2026-09-16T10:33:41.695Z", "dateUpdated": "2026-10-30T12:33:56.040Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:33:56.040Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix Use-After-Free in AIO error path\n\nIn ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io()\nfails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is\nfreed. However, for AIO operations, the kiocb cancel function was already\narmed and kiocb->private was set to `p`.\n\nIf a concurrent cancel operation (such as sys_io_cancel()) executes after\nffs_epfile_io() fails but before the function frees `p`, a Use-After-Free\ncan occur when the cancellation handler accesses the freed pointer.\n\nTo securely fix this race condition, we must properly un-arm the\ncancellation. Invoking `kiocb->ki_complete()` does exactly this by\nacquiring `ctx->ctx_lock` and safely removing the kiocb from the active\nsequence. In doing so, it ensures that a parallel io_cancel can no longer\ndiscover the kiocb, effectively closing the race window.\n\nWe then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been\nconsumed and it should avoid attempting to complete the request again or\ntriggering subsequent completion handlers."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is in FunctionFS epfile AIO (`ffs_epfile_write_iter`/`read_iter` via `io_submit`/`io_cancel` on functionfs ep files), a local syscall path. `ffs_epfile_io()` can fail with `-EAGAIN` on `O_NONBLOCK` before any USB host is involved; this is the gadget userspace API, matching CVE-2024-36894/CVE-2026-63894 as Local rather than Physical.\nAC:L - The attacker controls both sides: one thread `io_submit`s AIO that fails after `kiocb_set_cancel_fn` (O_NONBLOCK `-EAGAIN`, halt, `-EFAULT`), while another calls `io_cancel`/`io_destroy`. The race between `kfree(p)` and `aio_remove_iocb` is freely retryable, so a race the attacker creates is AC:L.\nPR:L - FunctionFS mounts commonly use `uid=`/`gid=`/`fmode=` to delegate ep files to unprivileged gadget daemons (adbd/shell on Android, MTP, embedded USB services). Once mounted by init, those accounts can open ep files and issue AIO without init-namespace root.\nUI:N - The attacker performs `io_submit` and `io_cancel`/`io_destroy` on their own FunctionFS endpoint fds. No separate victim action is required beyond an already-deployed FunctionFS gadget.\nS:U - The use-after-free corrupts kernel heap (`ffs_io_data`) within the same host kernel security authority. This is ordinary local privilege escalation, not a VM escape or IOMMU/sandbox boundary cross.\nC:H - Use-after-free of `ffs_io_data`: `ffs_aio_cancel()` reads `kiocb->private` after `kfree`. Reclaim of that kmalloc object lets the attacker control `io_data->ep`/`req` and leak kernel memory via UDC dequeue; UAFs are scored High for confidentiality.\nI:H - A reclaimed `ffs_io_data` yields attacker-controlled pointers passed to `usb_ep_dequeue()` from `ffs_aio_cancel`, providing a heap write and control-flow hijack primitive. Kernel UAFs are scored High for integrity.\nA:H - Dereferencing the freed `ffs_io_data` in `ffs_aio_cancel` causes kernel oops/panic even without a full exploit; any such crash is High availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_fs.c"], "versions": [{"version": "de2080d41b5d584205e408d72021f0f335a046fc", "lessThan": "922a29e1f8573fd405eea1a73a52112c4e7fcfc4", "status": "affected", "versionType": "git"}, {"version": "de2080d41b5d584205e408d72021f0f335a046fc", "lessThan": "0a2f71ccf9c2053de725e9a7922d081f3f3a3804", "status": "affected", "versionType": "git"}, {"version": "de2080d41b5d584205e408d72021f0f335a046fc", "lessThan": "b5f0e80a03e87bd932487e03248eae3ba3ed7b45", "status": "affected", "versionType": "git"}, {"version": "de2080d41b5d584205e408d72021f0f335a046fc", "lessThan": "153b5ecd29ed055562400bc17c91df3fd869b0ce", "status": "affected", "versionType": "git"}, {"version": "de2080d41b5d584205e408d72021f0f335a046fc", "lessThan": "4a2fb2d12b87b43724230abb52a1440617c7b6cc", "status": "affected", "versionType": "git"}, {"version": "de2080d41b5d584205e408d72021f0f335a046fc", "lessThan": "e78dcb1f7ec271449c54984dc90c62a5ba272de7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_fs.c"], "versions": [{"version": "4.0", "status": "affected"}, {"version": "0", "lessThan": "4.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/922a29e1f8573fd405eea1a73a52112c4e7fcfc4"}, {"url": "https://git.kernel.org/stable/c/0a2f71ccf9c2053de725e9a7922d081f3f3a3804"}, {"url": "https://git.kernel.org/stable/c/b5f0e80a03e87bd932487e03248eae3ba3ed7b45"}, {"url": "https://git.kernel.org/stable/c/153b5ecd29ed055562400bc17c91df3fd869b0ce"}, {"url": "https://git.kernel.org/stable/c/4a2fb2d12b87b43724230abb52a1440617c7b6cc"}, {"url": "https://git.kernel.org/stable/c/e78dcb1f7ec271449c54984dc90c62a5ba272de7"}], "title": "usb: gadget: f_fs: Fix Use-After-Free in AIO error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_fs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "922a29e1f8573fd405eea1a73a52112c4e7fcfc4", "status": "affected", "version": "de2080d41b5d584205e408d72021f0f335a046fc", "versionType": "git"}, {"lessThan": "0a2f71ccf9c2053de725e9a7922d081f3f3a3804", "status": "affected", "version": "de2080d41b5d584205e408d72021f0f335a046fc", "versionType": "git"}, {"lessThan": "b5f0e80a03e87bd932487e03248eae3ba3ed7b45", "status": "affected", "version": "de2080d41b5d584205e408d72021f0f335a046fc", "versionType": "git"}, {"lessThan": "153b5ecd29ed055562400bc17c91df3fd869b0ce", "status": "affected", "version": "de2080d41b5d584205e408d72021f0f335a046fc", "versionType": "git"}, {"lessThan": "4a2fb2d12b87b43724230abb52a1440617c7b6cc", "status": "affected", "version": "de2080d41b5d584205e408d72021f0f335a046fc", "versionType": "git"}, {"lessThan": "e78dcb1f7ec271449c54984dc90c62a5ba272de7", "status": "affected", "version": "de2080d41b5d584205e408d72021f0f335a046fc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_fs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.0"}, {"lessThan": "4.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix Use-After-Free in AIO error path\n\nIn ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io()\nfails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is\nfreed. However, for AIO operations, the kiocb cancel function was already\narmed and kiocb->private was set to `p`.\n\nIf a concurrent cancel operation (such as sys_io_cancel()) executes after\nffs_epfile_io() fails but before the function frees `p`, a Use-After-Free\ncan occur when the cancellation handler accesses the freed pointer.\n\nTo securely fix this race condition, we must properly un-arm the\ncancellation. Invoking `kiocb->ki_complete()` does exactly this by\nacquiring `ctx->ctx_lock` and safely removing the kiocb from the active\nsequence. In doing so, it ensures that a parallel io_cancel can no longer\ndiscover the kiocb, effectively closing the race window.\n\nWe then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been\nconsumed and it should avoid attempting to complete the request again or\ntriggering subsequent completion handlers."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_fs: Correcci\u00f3n de Uso despu\u00e9s de liberaci\u00f3n en la ruta de error de AIO\n\nEn ffs_epfile_write_iter() y ffs_epfile_read_iter(), cuando ffs_epfile_io() falla con un error distinto de -EIOCBQUEUED, la estructura io_data ('p') es liberada. Sin embargo, para operaciones AIO, la funci\u00f3n de cancelaci\u00f3n de kiocb ya estaba armada y kiocb -> private se hab\u00eda establecido en 'p'.\n\nSi una operaci\u00f3n de cancelaci\u00f3n concurrente (como sys_io_cancel()) se ejecuta despu\u00e9s de que ffs_epfile_io() falla pero antes de que la funci\u00f3n libere 'p', puede ocurrir un Uso despu\u00e9s de liberaci\u00f3n cuando el gestor de cancelaci\u00f3n accede al puntero liberado.\n\nPara corregir de forma segura esta condici\u00f3n de carrera, debemos desarmar correctamente la cancelaci\u00f3n. Invocar 'kiocb -> ki_complete()' hace exactamente esto al adquirir 'ctx -> ctx_lock' y eliminar de forma segura el kiocb de la secuencia activa. Al hacerlo, asegura que un io_cancel paralelo ya no pueda descubrir el kiocb, cerrando eficazmente la ventana de carrera.\n\nLuego devolvemos -EIOCBQUEUED para notificar a la capa VFS que el kiocb ha sido consumido y que debe evitar intentar completar la solicitud de nuevo o activar gestores de finalizaci\u00f3n posteriores."}], "id": "CVE-2026-90044", "lastModified": "2026-10-30T13:20:39.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:17:17.660", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0a2f71ccf9c2053de725e9a7922d081f3f3a3804"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/153b5ecd29ed055562400bc17c91df3fd869b0ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4a2fb2d12b87b43724230abb52a1440617c7b6cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/922a29e1f8573fd405eea1a73a52112c4e7fcfc4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b5f0e80a03e87bd932487e03248eae3ba3ed7b45"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e78dcb1f7ec271449c54984dc90c62a5ba272de7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de2080d41b5d584205e408d72021f0f335a046fc,153b5ecd29ed055562400bc17c91df3fd869b0ce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de2080d41b5d584205e408d72021f0f335a046fc,4a2fb2d12b87b43724230abb52a1440617c7b6cc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de2080d41b5d584205e408d72021f0f335a046fc,e78dcb1f7ec271449c54984dc90c62a5ba272de7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.51,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.5,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-17T01:15:03.850384+00:00", "updated": "2026-09-18T05:30:04.246333+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416"]}