Riskcovery

CVE-2026-93121

usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths

State
Published
Severity
7.0 High
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 17, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths

The error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM) in ffs_dmabuf_transfer() jump to err_fence_put which calls dma_fence_put() on the fence. However, at that point the fence has only been kmalloc'd — dma_fence_init() has not been called yet, so the refcount and the fence ops are uninitialized. Calling dma_fence_put() on such an object leads to undefined behavior.

Use kfree() instead, since the fence is just a plain allocation at this stage, and rename the label to err_fence_free to reflect the actual cleanup action.

Scores

CVSSScoreVectorSource
3.17.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7b07a2a7ca02a20124b552be96c5a56910795488 to before be539138d9a187af3b884525a395db10797c64f1Affected
  • 7b07a2a7ca02a20124b552be96c5a56910795488 to before 5fd8baacc7dc477df9cac61b45491840247a9b1eAffected
  • 7b07a2a7ca02a20124b552be96c5a56910795488 to before 58952c83dfe6ea3294a74734d2d1018c1120779aAffected
  • 7b07a2a7ca02a20124b552be96c5a56910795488 to before 621707dc67c9846fd876d7579ec951d92aa033f1Affected
LinuxLinux
  • 6.9Affected
  • before 6.9Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.