CVE-2026-90045

USB: gadget: ffs: fix mm lifetime handling

State: Published
Severity: 7.8 High
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: ffs: fix mm lifetime handling

io_data stores a pointer to the submitting task's mm_struct, but does not currently hold a reference to it while async requests are pending.

This can result in a use-after-free if the task exits before completion handling finishes.

Take a reference with mmgrab() when queuing the read request and release it with mmdrop() on request completion.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before 68895e50c2250d9edd6e0a5967bf351221fd88b4Affected 2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before aee2fde0f39e2b667084f4d5cc323a5c5543d733Affected 2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before 1625827648f4e1595ea6ba5521bc87ee5088b32bAffected 2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before f3d31484b3f26d63c09e5569ebfaa1079a17f171Affected 2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before 7411de0ce3b45286de1de82526795658ea6eacb0Affected 2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before 5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8Affected
LinuxLinux	3.15Affected before 3.15Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before 68895e50c2250d9edd6e0a5967bf351221fd88b4Affected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before aee2fde0f39e2b667084f4d5cc323a5c5543d733Affected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before 1625827648f4e1595ea6ba5521bc87ee5088b32bAffected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before f3d31484b3f26d63c09e5569ebfaa1079a17f171Affected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before 7411de0ce3b45286de1de82526795658ea6eacb0Affected
2e4c7553cd6f9c68bb741582dcb614edcbeca70f to before 5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8Affected

LinuxLinux

3.15Affected
before 3.15Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.