PT-2026-93686

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the USB gadget functionfs ffs component. The io data structure stores a pointer to the mm struct of the submitting task but fails to maintain a reference...

PT-2026-93685

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free issue exists in the USB gadget functionfs module. In the ffs epfile write iter and ffs epfile read iter functions, when ffs epfile io fails with an error other than...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent race during ffsep0queuewait When performing fast composition switching, there is a possibility that the process of ffsep0write/ffsep0read may enter a race condition due to ep0req being freed from the...

Linux Distros Unpatched Vulnerability : CVE-2026-89732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setu...

CVE-2026-89732

A flaw was found in the Linux kernel's USB FunctionFS ffs module. A local attacker could exploit a deadlock vulnerability in the ffsep0read function. This occurs when a userspace daemon polls ep0 and the USB gadget is simultaneously torn down, causing the kernel to enter an unresponsive state. Th...

DEBIAN-CVE-2026-89732

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls waiteventinterruptibleexclusivelockedi...

AZL-100160 CVE-2026-89732 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls waiteventinterruptibleexclusivelockedi...

UBUNTU-CVE-2026-89732

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls waiteventinterruptibleexclusivelockedi...

CVE-2026-89732

CVE-2026-89732 is a deadlock in the Linux kernel 's USB gadget f_fs (function filesystem) subsystem. The root cause is that ffs_ep0_read() holds ffs->mutex while calling wait_event_interruptible_exclusive_locked_irq(), which sleeps without releasing the mutex. When a userspace daemon is pollin...

CVE-2026-89732

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls waiteventinterruptibleexclusivelockedi...

CVE-2026-64594

The CVE affects the Linux kernel USB gadget subsystem (functionfs) and specifically f_fs. The bug occurs because ffs->reset_work is not initialized on all code paths; it is only initialized via INIT_WORK() in ffs_func_set_alt() and ffs_func_disable() under FFS_DEACTIVATED, and only after ffs_d...

CVE-2026-64594

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: initialize resetwork at allocation time ffsfskillsb unconditionally calls cancelworksync on ffs-resetwork when a functionfs instance is unmounted: ffsdataresetffs; cancelworksync&ffs-resetwork; However...

PT-2026-68427

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB gadget functionfs module where reset work is not consistently initialized. When a functionfs instance is unmounted, the ffs fs kill sb function calls cancel wo...

CVE-2026-64327

A flaw was found in the Linux kernel's FunctionFS ffs module, which handles USB gadget functionality. This vulnerability occurs because the endpoint direction epfile-in was not correctly initialized until a USB host connected. Consequently, early operations initiated by userspace programs could...

SUSE CVE-2026-64327

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

SUSE CVE-2026-64331

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64331

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64331

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64327

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

UBUNTU-CVE-2026-64327

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...