SB20260720346 - Use-after-free in Linux kernel gadget function driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-63894)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the FunctionFS DMABUF cancel and release paths when handling a concurrent request completion and detach or close operation. A local privileged user can trigger a DMABUF detach ioctl or close the FunctionFS device during request completion to cause a denial of service.

The issue is reachable from the FunctionFS device node and is not reachable from an attached USB host on the cable. Deployments may delegate the device node to a non-root gadget service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2796646f6d892c1eb6818c7ca41fdfa12568e8d1
• https://git.kernel.org/stable/c/552dae28dbeb5f7c4fafcda43962dc46569f58a0
• https://git.kernel.org/stable/c/c7d421123b98d5e9c1c84bd9957aba36f1cbb4ca
• https://git.kernel.org/stable/c/c872d8a065b3b499ce4c3ad168b5d34b68524f66