7.8

CVE-2026-90045

USB: gadget: ffs: fix mm lifetime handling

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: ffs: fix mm lifetime handling

io_data stores a pointer to the submitting task's mm_struct,
but does not currently hold a reference to it while async
requests are pending.

This can result in a use-after-free if the task exits before
completion handling finishes.

Take a reference with mmgrab() when queuing the read request
and release it with mmdrop() on request completion.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 2e4c7553cd6f9c68bb741582dcb614edcbeca70f
Version < 1625827648f4e1595ea6ba5521bc87ee5088b32b
Status affected
Version 2e4c7553cd6f9c68bb741582dcb614edcbeca70f
Version < f3d31484b3f26d63c09e5569ebfaa1079a17f171
Status affected
Version 2e4c7553cd6f9c68bb741582dcb614edcbeca70f
Version < 7411de0ce3b45286de1de82526795658ea6eacb0
Status affected
Version 2e4c7553cd6f9c68bb741582dcb614edcbeca70f
Version < 5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 3.15
Status affected
Version 0
Version < 3.15
Status unaffected
Version <= 6.12.*
Version 6.12.111
Status unaffected
Version <= 6.18.*
Version 6.18.51
Status unaffected
Version <= 7.2.*
Version 7.2.5
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.15% 0.043
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171
https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0
https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8
https://git.kernel.org/stable/c/1625827648f4e1595ea6ba5521bc87ee5088b32b