CVE-2026-93121usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths The error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM) in ffs_dmabuf_transfer() jump to err_fence_put which calls dma_fence_put() on the fence. However, at that point the fence has only been kmalloc'd — dma_fence_init() has not been called yet, so the refcount and the fence ops are uninitialized. Calling dma_fence_put() on such an object leads to undefined behavior. Use kfree() instead, since the fence is just a plain allocation at this stage, and rename the label to err_fence_free to reflect the actual cleanup action.
- CVSS
- 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7b07a2a7ca02a20124b552be96c5a56910795488 before be539138d9a187af3b884525a395db10797c64f1; 7b07a2a7ca02a20124b552be96c5a56910795488 builds before 5fd8baacc7dc477df9cac61b45491840247a9b1e; from 7b07a2a7ca02a20124b552be96c5a56910795488 before 58952c83dfe6ea3294a74734d2d1018c1120779a; from 7b07a2a7ca02a20124b552be96c5a56910795488 before 621707dc67c9846fd876d7579ec951d92aa033f1 | CNA record |
References
- https://git.kernel.org/stable/c/be539138d9a187af3b884525a395db10797c64f1
- https://git.kernel.org/stable/c/5fd8baacc7dc477df9cac61b45491840247a9b1e
- https://git.kernel.org/stable/c/58952c83dfe6ea3294a74734d2d1018c1120779a
- https://git.kernel.org/stable/c/621707dc67c9846fd876d7579ec951d92aa033f1
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.