CVE-2026-98764

A flaw was found in the Linux kernel's USB Universal Serial Bus FunctionFS gadget subsystem. A local user can cause a Denial of Service DoS by triggering a kernel crash when querying endpoint descriptors on a USB gadget configured with lower-speed settings than the active connection speed. In thi...

AZL-108765 CVE-2026-98764 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

CVE-2026-98764

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

EUVD-2026-103849

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

PT-2026-116983

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f fs: Fix NULL pointer dereference in FUNCTIONFS ENDPOINT DESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFS HAS FS DESC and the gadget operates at a higher speed such a...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability arises when the user space provides full-speed descriptors, and FunctionFS runs at a higher speed. In this case, the FUNCTIONFSENDPOINTDESC ioctl only selects the endpoint descriptor at the current speed, without retreating to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Remove WARNON from functionfsbind This commit addresses an issue related to a kernel panic that occurs when paniconwarn is enabled. The issue is caused by the unnecessary use of WARNON in functionfsbind, which c...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent race during ffsep0queuewait When performing fast composition switching, there is a possibility that the process of ffsep0write/ffsep0read may enter a race condition due to ep0req being freed from the...

PT-2026-93685

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free issue exists in the USB gadget functionfs module. In the ffs epfile write iter and ffs epfile read iter functions, when ffs epfile io fails with an error other than...

PT-2026-93686

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the USB gadget functionfs ffs component. The io data structure stores a pointer to the mm struct of the submitting task but fails to maintain a reference...

Linux Distros Unpatched Vulnerability : CVE-2026-89732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setu...

CVE-2026-89732

A flaw was found in the Linux kernel's USB FunctionFS ffs module. A local attacker could exploit a deadlock vulnerability in the ffsep0read function. This occurs when a userspace daemon polls ep0 and the USB gadget is simultaneously torn down, causing the kernel to enter an unresponsive state. Th...

AZL-100160 CVE-2026-89732 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls waiteventinterruptibleexclusivelockedi...

DEBIAN-CVE-2026-89732

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls waiteventinterruptibleexclusivelockedi...

UBUNTU-CVE-2026-89732

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls waiteventinterruptibleexclusivelockedi...

CVE-2026-89732

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls waiteventinterruptibleexclusivelockedi...

CVE-2026-89732

CVE-2026-89732 is a deadlock in the Linux kernel 's USB gadget f_fs (function filesystem) subsystem. The root cause is that ffs_ep0_read() holds ffs->mutex while calling wait_event_interruptible_exclusive_locked_irq(), which sleeps without releasing the mutex. When a userspace daemon is pollin...

CVE-2026-64594

The CVE affects the Linux kernel USB gadget subsystem (functionfs) and specifically f_fs. The bug occurs because ffs->reset_work is not initialized on all code paths; it is only initialized via INIT_WORK() in ffs_func_set_alt() and ffs_func_disable() under FFS_DEACTIVATED, and only after ffs_d...

PT-2026-68427

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB gadget functionfs module where reset work is not consistently initialized. When a functionfs instance is unmounted, the ffs fs kill sb function calls cancel wo...

CVE-2026-64594

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: initialize resetwork at allocation time ffsfskillsb unconditionally calls cancelworksync on ffs-resetwork when a functionfs instance is unmounted: ffsdataresetffs; cancelworksync&ffs-resetwork; However...