CVE-2026-64594

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: initialize reset_work at allocation time

ffs_fs_kill_sb() unconditionally calls cancel_work_sync() on

ffs->reset_work when a functionfs instance is unmounted:

ffs_data_reset(ffs);

cancel_work_sync(&ffs->reset_work);

However ffs->reset_work is only ever initialized via INIT_WORK() in

ffs_func_set_alt() and ffs_func_disable(), and only on the

FFS_DEACTIVATED path. That state is reached solely by ffs_data_closed()

when the instance is mounted with the "no_disconnect" option, so for the

common case (no "no_disconnect", or mounted and unmounted without ever

being deactivated) reset_work is never initialized.

ffs_data_new() allocates the ffs_data with kzalloc_obj() and does not

initialize reset_work, and ffs_data_reset()/ffs_data_clear() do not touch

it either, so reset_work.func is left NULL. cancel_work_sync() on such a

work then trips the WARN_ON(!work->func) guard in __flush_work():

WARNING:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References