Cloudanix VulnDB

CVE-2026-93121

High · 7.0

CVSS

7.0

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A mistake in Linux kernel USB gadget code could let a local user cause crashes or memory problems by triggering certain error conditions during data transfers.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Calling dma_fence_put() on a kmalloc'd but uninitialized dma_fence object (refcount and ops unset) in ffs_dmabuf_transfer() error paths triggers undefined behavior and potential memory corruption.

Why it matters to the business

Local users on affected Linux kernels can trigger kernel instability or memory corruption via USB gadget functionfs endpoints, risking denial of service or local privilege escalation on systems handling USB transfers.

How an attack unfolds

An attacker with local access triggers the ESHUTDOWN or ENOMEM error paths in ffs_dmabuf_transfer() by disabling an endpoint or inducing allocation failure, causing the kernel to invoke dma_fence_put on an uninitialized object and resulting in undefined behavior that may be leveraged for corruption.

How to fix it

Apply the upstream fix that replaces dma_fence_put with kfree and renames the label to err_fence_free; rebuild and deploy updated kernel images containing this change.

How to confirm the fix worked

Inspect the f_fs.c source for the corrected err_fence_free label and kfree call; verify the running kernel was built after the patch commit or test error paths with endpoint-disable and allocation-failure scenarios.

Typical attack path

  1. Obtain local user access on a Linux system using usb gadget f_fs
  2. Trigger endpoint disable or memory allocation failure during dmabuf transfer setup
  3. Force execution of the err_fence_put path before dma_fence_init
  4. Exploit resulting undefined behavior for memory corruption or crash

How to detect it

Review kernel logs for unexpected oops, warnings, or corruption near f_fs or dma_fence code; examine USB gadget functionfs activity logs around transfer failures for patterns matching the error paths.

What your security team should do

  • Prioritize kernel updates on systems exposing USB gadget interfaces
  • Audit custom kernels or backports for the presence of the uninitialized fence cleanup bug
  • Monitor for local privilege-escalation attempts targeting USB gadget subsystems

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths The error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM) in ffs_dmabuf_transfer() jump to err_fence_put which calls dma_fence_put() on the fence. However, at that point the fence has only been kmalloc'd — dma_fence_init() has not been called yet, so the refcount and the fence ops are uninitialized. Calling dma_fence_put() on such an object leads to undefined behavior. Use kfree() instead, since the fence is just a plain allocation at this stage, and rename the label to err_fence_free to reflect the actual cleanup action.

Affected packages

Ecosystem Package Introduced Fixed