CVE-2026-90044
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix Use-After-Free in AIO error path In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is freed. However, for AIO operations, the kiocb cancel function was already armed and kiocb->private was set to `p`. If a concurrent cancel operation (such as sys_io_cancel()) executes after ffs_epfile_io() fails but before the function frees `p`, a Use-After-Free can occur when the cancellation handler accesses the freed pointer. To securely fix this race condition, we must properly un-arm the cancellation. Invoking `kiocb->ki_complete()` does exactly this by acquiring `ctx->ctx_lock` and safely removing the kiocb from the active sequence. In doing so, it ensures that a parallel io_cancel can no longer discover the kiocb, effectively closing the race window. We then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been consumed and it should avoid attempting to complete the request again or triggering subsequent completion handlers.
INFO
Published Date :
Sept. 16, 2026, 11:17 a.m.
Last Modified :
Oct. 30, 2026, 1:20 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Un-arm the cancellation handler before freeing the pointer.
- Acquire ctx->ctx_lock to safely remove kiocb.
- Return -EIOCBQUEUED to VFS layer.
- Ensure kiocb is not completed again.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-90044.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-90044 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-90044
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-90044 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-90044 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 30, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90044.json">CVE-2026-90044</a> Added Reference https://git.kernel.org/stable/c/922a29e1f8573fd405eea1a73a52112c4e7fcfc4 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 21, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90044.json">CVE-2026-90044</a> Added Reference https://git.kernel.org/stable/c/0a2f71ccf9c2053de725e9a7922d081f3f3a3804 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 19, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90044.json">CVE-2026-90044</a> -
CVE Translated by [email protected]
Sep. 28, 2026
Action Type Old Value New Value Added Translation Title: la biblioteca CGM_NIST_Loader.dll en JT2Go, Teamcenter Visualization, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: usb: gadget: f_fs: Corrección de Uso después de liberación en la ruta de error de AIO En ffs_epfile_write_iter() y ffs_epfile_read_iter(), cuando ffs_epfile_io() falla con un error distinto de -EIOCBQUEUED, la estructura io_data ('p') es liberada. Sin embargo, para operaciones AIO, la función de cancelación de kiocb ya estaba armada y kiocb -> private se había establecido en 'p'. Si una operación de cancelación concurrente (como sys_io_cancel()) se ejecuta después de que ffs_epfile_io() falla pero antes de que la función libere 'p', puede ocurrir un Uso después de liberación cuando el gestor de cancelación accede al puntero liberado. Para corregir de forma segura esta condición de carrera, debemos desarmar correctamente la cancelación. Invocar 'kiocb -> ki_complete()' hace exactamente esto al adquirir 'ctx -> ctx_lock' y eliminar de forma segura el kiocb de la secuencia activa. Al hacerlo, asegura que un io_cancel paralelo ya no pueda descubrir el kiocb, cerrando eficazmente la ventana de carrera. Luego devolvemos -EIOCBQUEUED para notificar a la capa VFS que el kiocb ha sido consumido y que debe evitar intentar completar la solicitud de nuevo o activar gestores de finalización posteriores. -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 21, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90044.json">CVE-2026-90044</a> Added Reference https://git.kernel.org/stable/c/b5f0e80a03e87bd932487e03248eae3ba3ed7b45 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 16, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 16, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix Use-After-Free in AIO error path In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is freed. However, for AIO operations, the kiocb cancel function was already armed and kiocb->private was set to `p`. If a concurrent cancel operation (such as sys_io_cancel()) executes after ffs_epfile_io() fails but before the function frees `p`, a Use-After-Free can occur when the cancellation handler accesses the freed pointer. To securely fix this race condition, we must properly un-arm the cancellation. Invoking `kiocb->ki_complete()` does exactly this by acquiring `ctx->ctx_lock` and safely removing the kiocb from the active sequence. In doing so, it ensures that a parallel io_cancel can no longer discover the kiocb, effectively closing the race window. We then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been consumed and it should avoid attempting to complete the request again or triggering subsequent completion handlers. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90044.json">CVE-2026-90044</a> Added Reference https://git.kernel.org/stable/c/153b5ecd29ed055562400bc17c91df3fd869b0ce Added Reference https://git.kernel.org/stable/c/4a2fb2d12b87b43724230abb52a1440617c7b6cc Added Reference https://git.kernel.org/stable/c/e78dcb1f7ec271449c54984dc90c62a5ba272de7