CVE-2026-63894 usb: gadget: f_fs: serialize DMABUF cancel against request completion

🗓️ 19 Jul 2026 14:55:04Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Linux kernel USB gadget FunctionFS DMABUF cancel race causes use-after-free; fix clears priv->req under eps_lock in cleanup.

Reporter	Title	Published	Views	Family All 8
CVE	CVE-2026-63894	19 Jul 202614:55	–	cve
Cvelist	CVE-2026-63894 usb: gadget: f_fs: serialize DMABUF cancel against request completion	19 Jul 202614:55	–	cvelist
EUVD	EUVD-2026-45667	19 Jul 202614:55	–	euvd
NVD	CVE-2026-63894	19 Jul 202616:17	–	nvd
OSV	DEBIAN-CVE-2026-63894	19 Jul 202616:17	–	osv
OSV	UBUNTU-CVE-2026-63894	20 Jul 202600:00	–	osv
Positive Technologies	PT-2026-61211	19 Jul 202600:00	–	ptsecurity
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-63894	20 Jul 202600:00	–	nessus

Source	Link
git	www.git.kernel.org/stable/c/2796646f6d892c1eb6818c7ca41fdfa12568e8d1
git	www.git.kernel.org/stable/c/552dae28dbeb5f7c4fafcda43962dc46569f58a0
git	www.git.kernel.org/stable/c/c7d421123b98d5e9c1c84bd9957aba36f1cbb4ca
git	www.git.kernel.org/stable/c/c872d8a065b3b499ce4c3ad168b5d34b68524f66
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63894.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-63894
git	www.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

21 Jul 2026 03:47Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.17.8

EPSS0.002