CVE-2026-64327

What it actually does

This is a Linux kernel USB gadget FunctionFS flaw in which endpoint direction state is not initialized early enough. Before a USB host connects, userspace can issue FunctionFS DMA-BUF-related ioctls such as FUNCTIONFS_DMABUF_ATTACH against endpoint files while epfile->in is still unset. The kernel may then apply the wrong DMA direction for the endpoint, which can cause incorrect DMA mapping behavior. Depending on hardware, kernel configuration, and the calling process privileges, the practical impact may include device malfunction, data corruption, kernel instability, or potentially unintended memory exposure/corruption in USB gadget deployments. The issue is local to systems using Linux USB gadget FunctionFS functionality and is not a typical remote network attack surface.

Why it matters to the business

Organizations using Linux-based embedded devices, appliances, phones, kiosks, development boards, or USB gadget-mode systems could experience instability or data-handling errors when FunctionFS endpoints are manipulated before host connection. The likely operational risk is device crash, unreliable USB behavior, or service disruption rather than broad internet-scale compromise. EPSS is very low at 0.002, it is not listed in CISA KEV, no ransomware use is reported, and no public exploit maturity is indicated, so remediation should be handled through normal kernel update processes unless the organization operates exposed or safety-critical USB gadget devices.

How an attack unfolds

An attacker first needs local ability to interact with a Linux system configured to use USB gadget FunctionFS, typically through a process that can access mounted FunctionFS endpoint files or influence the gadget userspace stack. The attacker then triggers endpoint descriptor parsing and, before a USB host connection causes normal endpoint enablement, opens endpoint files and issues early ioctls such as FUNCTIONFS_DMABUF_ATTACH. Because the endpoint direction field was not initialized at that stage in vulnerable kernels, the kernel may treat an IN endpoint as the wrong direction or otherwise apply incorrect DMA semantics. Exploitation would depend heavily on the device controller, IOMMU/DMA behavior, kernel build, and permissions. There is currently no indication of public weaponization or known threat actor exploitation.

How to fix it

Update the Linux kernel to a version that includes the upstream fix for FunctionFS endpoint direction initialization in f_fs. The fix initializes epfile->in during endpoint file creation rather than waiting until endpoint enablement after host connection. Where vendor kernels are used, apply the relevant distribution, device vendor, Android/BSP, or embedded Linux kernel update once available. If immediate patching is not possible, reduce risk by disabling unused USB gadget and FunctionFS functionality, restricting access to FunctionFS mount points and endpoint files, preventing untrusted userspace from issuing FunctionFS ioctls, and limiting DMA-BUF use in gadget userspace components where operationally feasible.

How to confirm the fix worked

Confirm the running kernel includes the FunctionFS fix by checking vendor advisories, kernel changelogs, or source patches for initialization of epfile->in in ffs_epfiles_create() or equivalent FunctionFS endpoint-file creation logic. Verify the runtime kernel version with uname -a and compare it against the vendor-fixed build once published. On source-based systems, inspect drivers/usb/gadget/function/f_fs.c for the corrected initialization path. Confirm whether FunctionFS is in use by checking for mounted functionfs filesystems, configured USB gadgets under configfs, loaded gadget modules, and active gadget userspace processes. After remediation, test normal USB gadget operation, including pre-host-connection endpoint setup and DMA-BUF attach workflows if used.

Typical attack path

1. Identify a Linux device or embedded platform configured with USB gadget FunctionFS support.
2. Obtain local code execution or control of a userspace process that can access the FunctionFS mount and endpoint files.
3. Provide or trigger FunctionFS endpoint descriptors so the kernel builds endpoint address mapping.
4. Before the USB host connects and before normal endpoint enablement occurs, open the affected endpoint files.
5. Invoke early FunctionFS DMA-BUF ioctls such as FUNCTIONFS_DMABUF_ATTACH.
6. Leverage the incorrect endpoint direction state to cause incorrect DMA mapping behavior, potentially resulting in crash, corruption, or unintended data handling depending on platform behavior.

How to detect it

There are no known public exploitation indicators for this issue, and exploitation would be highly platform-specific. To assess whether it may have been abused, review kernel logs for USB gadget, FunctionFS, DMA mapping, IOMMU, or kernel crash messages around times when a device was configured but not yet connected to a USB host. Examine auditd, eBPF, ftrace, or syscall tracing data if available for processes opening FunctionFS endpoint files and issuing FunctionFS ioctls before host connection. Review configfs changes under USB gadget paths, unexpected functionfs mounts, and unexpected processes interacting with gadget endpoint files. On embedded systems, correlate unexplained USB gadget resets, kernel oops/panic events, DMA faults, or IOMMU violations with local process activity. Because the vulnerability does not define a stable payload, file artifact, process name, or network signature, detection should focus on suspicious access patterns and kernel fault telemetry rather than fixed malware indicators.

• FUNCTIONFS_DMABUF_ATTACH
• functionfs
• usb_f_fs
• f_fs
• /sys/kernel/config/usb_gadget
• /dev/ffs
• /dev/functionfs
• DMA-API
• IOMMU fault
• usb: gadget
• Kernel panic
• BUG: unable to handle kernel
• Oops:

What your security team should do

• Inventory Linux systems, embedded devices, mobile/IoT platforms, and appliances that use USB gadget mode or FunctionFS.
• Prioritize patching for devices where untrusted or semi-trusted local code can access FunctionFS endpoint files, especially embedded products with broad physical or local user access.
• Track kernel, distribution, Android/BSP, and hardware vendor advisories for the fixed build because no product-specific fixed versions were provided in the input.
• Restrict permissions on FunctionFS mount points and endpoint files so only the intended gadget service account can access them.
• Disable unused USB gadget configurations, FunctionFS functions, and DMA-BUF paths where they are not required.
• Add monitoring for unexpected FunctionFS mounts, USB gadget configuration changes, and unusual use of FUNCTIONFS_DMABUF_ATTACH on systems where audit or tracing is available.
• Treat crashes, kernel warnings, DMA mapping errors, or unexplained USB gadget instability on vulnerable kernels as potential security-relevant events, even though no known exploitation is reported.