CVE-2026-63894

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: serialize DMABUF cancel against request completion

ffs_epfile_dmabuf_io_complete() calls usb_ep_free_request() on the

completed request but leaves priv->req, the back-pointer that

ffs_dmabuf_transfer() set on submission, pointing at the freed

memory. A later FUNCTIONFS_DMABUF_DETACH ioctl or

ffs_epfile_release() on the close path still sees priv->req

non-NULL under ffs->eps_lock:

if (priv->ep && priv->req)

usb_ep_dequeue(priv->ep, priv->req);

so usb_ep_dequeue() is called on a freed usb_request.

On dummy_hcd the dequeue path only walks a live queue and

pointer-compares, so the freed pointer reads without faulting and

KASAN requires an explicit check at the FunctionFS call site to

surface the use-after-free. On SG-capable in-tree UDCs the

dequeue path dereferences the supplied request immediately:

* chipidea's ep_dequeue() does

container_of(req, struct ci_hw_req, req) and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References