EUVD-2026-45667

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: serialize DMABUF cancel against request completion ffsepfiledmabufiocomplete calls usbepfreerequest on the completed request but leaves priv-req, the back-pointer that ffsdmabuftransfer set on submission, pointi...

CVE-2026-63894 usb: gadget: f_fs: serialize DMABUF cancel against request completion

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: serialize DMABUF cancel against request completion ffsepfiledmabufiocomplete calls usbepfreerequest on the completed request but leaves priv-req, the back-pointer that ffsdmabuftransfer set on submission, pointi...

CVE-2026-63894

Summary (CVE-2026-63894): A race in Linux kernel’s FunctionFS DMABUF handling allows a freed usb_request to be dequeued via an obsolete priv->req pointer when cancelling a DMABUF attachment. The root cause is that ffs_epfile_dmabuf_io_complete() frees the request but leaves priv->req pointi...

CVE-2026-63894 usb: gadget: f_fs: serialize DMABUF cancel against request completion

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: serialize DMABUF cancel against request completion ffsepfiledmabufiocomplete calls usbepfreerequest on the completed request but leaves priv-req, the back-pointer that ffsdmabuftransfer set on submission, pointi...

PT-2026-61211

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the FunctionFS gadget driver. The ffs epfile dmabuf io complete function calls usb ep free request on a completed request but fails to clear the priv-req...

PT-2026-61212

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f fs gadget driver where the ffs ep0 read function allocates a control-OUT data buffer using kmalloc based on the length specified in the Setup packet. When a shor...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent race conditions during ffsep0queuewait When performing fast composition switching, there is a possibility that the process of ffsep0write/ffsep0read may enter a race condition due to ep0req being freed...

CVE-2025-71074

In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffsepfileopen can race with removal, ending up with file-privatedata pointing to freed object. There is a total count of opened files on functionfs both ep0 and dynamic ones and when it hits...

CVE-2025-71074

In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffsepfileopen can race with removal, ending up with file-privatedata pointing to freed object. There is a total count of opened files on functionfs both ep0 and dynamic ones and when it hits...

UBUNTU-CVE-2025-71074

In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffsepfileopen can race with removal, ending up with file-privatedata pointing to freed object. There is a total count of opened files on functionfs both ep0 and dynamic ones and when it hits...

CVE-2025-71074

In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffsepfileopen can race with removal, ending up with file-privatedata pointing to freed object. There is a total count of opened files on functionfs both ep0 and dynamic ones and when it hits...

CVE-2025-71074 functionfs: fix the open/removal races

In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffsepfileopen can race with removal, ending up with file-privatedata pointing to freed object. There is a total count of opened files on functionfs both ep0 and dynamic ones and when it hits...

CVE-2025-71074

CVE-2025-71074 concerns the Linux kernel’s functionfs subsystem, where a race between open and removal can leave a freed object referenced by file->private_data. The root cause is the way ffs->opened is updated; using atomic_dec_and_test() vs atomic_add_return() leads to a window where an o...

CVE-2025-71074

In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffsepfileopen can race with removal, ending up with file-privatedata pointing to freed object. There is a total count of opened files on functionfs both ep0 and dynamic ones and when it hits...

CVE-2025-71074 functionfs: fix the open/removal races

In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffsepfileopen can race with removal, ending up with file-privatedata pointing to freed object. There is a total count of opened files on functionfs both ep0 and dynamic ones and when it hits...

Linux Distros Unpatched Vulnerability : CVE-2025-71074

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - functionfs: fix the open/removal races ffsepfileopen can race with removal, ending up with file-privatedata pointing to freed object. There is a total count of...

PT-2026-2595

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists within the functionfs implementation, specifically in the ffs epfile open function. This condition can occur when a file is opened and removed concurrently,...

EUVD-2025-201630

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix epfile null pointer access after ep enable. A race condition occurs when ffsfuncepsenable runs concurrently with ffsdatareset. The ffsdataclear called in ffsdatareset sets ffs-epfiles to NULL before resettin...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988808)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988808 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent race during ffsep0queuewait While performing fast composition switch,...

Siemens SIMATIC Devices Race Condition (CVE-2024-57913)

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Remove WARNON in functionfsbind This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...