CVE-2026-64328

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Fix DMA fence leak

In ffs_dmabuf_transfer(), a ffs_dma_fence object is kmalloc'd, with the

underlying dma_fence later initialized by dma_fence_init(), which sets

its kref counter to 1. Then, dma_resv_add_fence() gets a second

reference, and a pointer to the ffs_dma_fence is passed as the

usb_request's "context" field.

The dma-resv mechanism will manage the second reference, but the first

reference is never properly released; the ffs_dmabuf_cleanup() function

decreases the reference count, but only to balance with the reference

grab in ffs_dmabuf_signal_done().

The code will then slowly leak memory as more ffs_dma_fence objects are

created without being ever freed.

Address this issue by transferring ownership of the fence to the DMA

reservation object, by calling dma_fence_put() right after

dma_resv_add_fence(). The ffs_dma_fence then gets properly discarded

after being signalled.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References