Linux Kernel EUVD-2026-82229

Requires a Linux device operating in USB gadget/peripheral mode with the FunctionFS (f_fs) function and its DMABUF transfer support enabled (feature present since ~6.9). Exploitation requires local access to the FunctionFS/DMABUF endpoint and the ability to trigger one of two specific error paths in ffs_dmabuf_transfer(): endpoint-disabled (ESHUTDOWN) or request-allocation failure (ENOMEM). Limiting factors: not remotely reachable (AV:L), requires local privileges over the gadget interface (PR:L), and requires deliberately inducing an error condition rather than a normal transfer, which raises attack complexity (AC:H). Systems not configured as USB gadgets or not using f_fs DMABUF are unaffected.

This is a HIGH-CVSS-but-LOW-REAL-RISK issue. The vendor CVSS of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates confidentiality/integrity impact: the actual defect is calling dma_fence_put() on a fence that was only kmalloc'd - dma_fence_init() has not run, so the kref refcount and fence->ops are uninitialized. The dominant, well-characterized outcome is undefined behavior manifesting as a kernel crash/oops (decrementing a garbage refcount, possibly reaching release via an uninitialized ops function pointer), NOT information disclosure. There is no EPSS score, no CISA KEV listing, and no public exploit - signals all point to no known real-world exploitation. Attack complexity is genuinely high: the bug lives only on two error paths (endpoint-disabled ESHUTDOWN and request-allocation ENOMEM) inside ffs_dmabuf_transfer(), which an attacker must deliberately induce, and requires local access to a FunctionFS/DMABUF interface on a device operating in USB gadget mode. The CVSS vector and the description agree on local vector (AV:L), which is consistent. My independent assessment is closer to ~4.0-4.5. The 'Information Disclosure' tag conflicts with the technical facts - this is a denial-of-service (crash) bug, not disclosure.

A local process with access to the FunctionFS DMABUF endpoint on a device running in USB gadget mode issues a DMABUF transfer request while forcing an error condition - e.g. the endpoint is disabled (ESHUTDOWN) or memory pressure causes request allocation to fail (ENOMEM). The error path calls dma_fence_put() on a fence whose refcount and ops are still uninitialized, producing undefined behavior that typically crashes the kernel. No public exploit code exists at time of analysis.