CVE-2026-90045

The Linux kernel's USB gadget functionfs (ffs) driver stores a raw pointer to the submitting task's mm_struct for asynchronous I/O without holding a reference while requests are pending. A local user who queues async read requests through functionfs and then exits before completion handling finishes can trigger a use-after-free on the freed mm_struct. An attacker with low local privileges could potentially corrupt kernel memory to escalate privileges, read or write sensitive memory, or crash the system, consistent with the CVSS 3.1 score of 7.8 (AV:L/PR:L with high confidentiality, integrity, and availability impact). Any system running an affected kernel with the functionfs gadget in use is affected — a configuration common on Android devices (which use f_fs for ADB) and embedded/USB-peripheral deployments, but rare on typical servers and desktops. There is no public proof-of-concept, the issue is not in the CISA KEV catalog, and no in-the-wild exploitation is known.

What to do: Upgrade to a kernel release that includes the upstream fix, which takes an mmgrab() reference when queuing the ffs read request and drops it with mmdrop() on completion; since exact fixed version numbers are not provided in the data, track the stable branch containing this ffs patch. If the system does not need USB gadget/functionfs functionality, disable or unload the f_fs gadget module to eliminate the attack surface. Restrict local shell access on devices that do use functionfs (e.g., ADB-enabled Android builds) until patched.