CVE-2026-90044

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Fix Use-After-Free in AIO error path

In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io()

fails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is

freed. However, for AIO operations, the kiocb cancel function was already

armed and kiocb->private was set to `p`.

If a concurrent cancel operation (such as sys_io_cancel()) executes after

ffs_epfile_io() fails but before the function frees `p`, a Use-After-Free

can occur when the cancellation handler accesses the freed pointer.

To securely fix this race condition, we must properly un-arm the

cancellation. Invoking `kiocb->ki_complete()` does exactly this by

acquiring `ctx->ctx_lock` and safely removing the kiocb from the active

sequence. In doing so, it ensures that a parallel io_cancel can no longer

discover the kiocb, effectively closing the race window.

We then return -EIOCBQUEUED to notify the VFS layer t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References