EUVD-2026-80653
GHSA-g8pp-pjx5-c2hv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local functionfs access (AV:L/PR:L), a task-exit-vs-completion race (AC:H); UAF yields a crash (A:H) and minor memory corruption (I:L) with no disclosure (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: ffs: fix mm lifetime handling
io_data stores a pointer to the submitting task's mm_struct, but does not currently hold a reference to it while async requests are pending.
This can result in a use-after-free if the task exits before completion handling finishes.
Take a reference with mmgrab() when queuing the read request and release it with mmdrop() on request completion.
AnalysisAI
A use-after-free in the Linux kernel's USB gadget FunctionFS (f_fs) implementation allows a local user with access to a mounted functionfs instance to crash or corrupt the kernel by racing an asynchronous I/O request against the exit of the task that submitted it. The bug is reachable only on systems operating in USB device/gadget mode with FunctionFS configured (predominantly Android and embedded devices), requires the attacker to be able to submit AIO against the ffs endpoint files, and is timing-sensitive; it is not reachable on ordinary USB-host servers or workstations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) a kernel with USB gadget mode and the FunctionFS/f_fs function compiled and configured, and a mounted functionfs instance with endpoint files accessible to the attacker; (2) use of asynchronous I/O (io_submit/AIO) against those ffs endpoint files; and (3) winning a race in which the submitting task exits before async request completion handling runs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) materially overstates real-world risk for this bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.18.51, 7.2.5, or 7.3-rc1 (or later) - the fixes are the upstream stable/mainline commits https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171, https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8, and https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0, which add mmgrab() at async read queueing and mmdrop() at completion; distro and Android vendors should be tracked for their own backports. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems operating in USB gadget mode with FunctionFS enabled, particularly Android and embedded devices, and obtain the vendor-released kernel patch from your distribution vendor (e.g., Android Security Bulletin, Yocto, Ubuntu). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today