Cloudanix VulnDB

CVE-2026-80854

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux manages certain USB device connections can cause the whole computer to crash when devices are removed in a particular way.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition between usbg_port_unlink decrementing tpg_port_count in fabric_pre_unlink and core_dev_del_lun draining se_lun references allows tcm_usbg_drop_nexus to observe zero port count and invoke target_remove_session, freeing sess_cmd_map while an in-flight usbg_cmd and its work item remain active, producing use-after-free.

Why it matters to the business

Kernel crashes and unexpected reboots on Linux systems exposing USB gadget target-core LUNs, causing denial of service for storage or device-sharing workloads; low remote exploitability but local or USB-adjacent attackers can trigger instability.

How an attack unfolds

An attacker with local or USB-fabric access performs concurrent last-LUN unlinks while forcing nexus removal; the resulting race lets target_remove_session free the session command map before usbg_cmd_work completes, triggering DEBUG_OBJECTS warnings followed by target-core BUG or oops.

How to fix it

Apply a kernel patch that introduces the fabric_post_unlink callback so tpg_port_count stays nonzero until core_dev_del_lun finishes; rebuild and reboot with the corrected kernel.

How to confirm the fix worked

Boot the patched kernel, reproduce concurrent unlink/nexus removal workloads, and confirm absence of DEBUG_OBJECTS "free active" warnings for usbg_cmd_work or target-core BUG/Oops messages.

Typical attack path

  1. Obtain local or USB-gadget interface access on affected Linux kernel
  2. Trigger overlapping LUN unlink and nexus removal operations
  3. Race causes premature session free while usbg_cmd remains referenced
  4. Execute in-flight work item to access freed memory and induce crash

How to detect it

Inspect kernel logs for DEBUG_OBJECTS free-active warnings referencing usbg_cmd_work and any subsequent target-core BUG or oops entries indicating sess_cmd_map use-after-free.

  • usbg_cmd_work
  • DEBUG_OBJECTS.*free active
  • target_remove_session
  • tpg_port_count

What your security team should do

  • Prioritize kernel updates on all systems exposing USB gadget target functionality
  • Restrict unprivileged local access and USB gadget configuration where feasible
  • Add kernel oops and DEBUG_OBJECTS alerts to monitoring pipelines

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: keep port count until LUN teardown completes tcm_usbg_drop_nexus() permits session removal once tpg_port_count reaches zero. However, usbg_port_unlink() currently decrements that count from the fabric_pre_unlink() callback, before core_dev_del_lun() waits for active se_lun references to drain. If removal of the last LUN races a nexus removal, the latter can observe a zero port count and call target_remove_session(). This frees sess_cmd_map while an in-flight struct usbg_cmd, including its work item, can still be accessed. Overlapping the last-LUN unlink with nexus removal reproduces this lifetime violation as a DEBUG_OBJECTS "free active" warning for usbg_cmd_work, followed by a target-core BUG/Oops. The generic target-core unlink path has no callback after core_dev_del_lun() completes. Add an optional fabric_post_unlink() callback and use it for the f_tcm port count. The count now remains nonzero until core_dev_del_lun() has finished draining active LUN references, preventing nexus removal from freeing the session during command completion.

Affected packages

Ecosystem Package Introduced Fixed