CVE-2026-63894

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the FunctionFS gadget driver. The ffs epfile dmabuf io complete() function calls usb ep free request() on a completed request but fails to clear the priv->req back-pointer. Consequently, a subsequent FUNCTIONFS DMABUF DETACH ioctl or ffs epfile release() call may still perceive priv->req as non-NULL while holding the eps lock, leading to a call to usb ep dequeue() using a freed usb request pointer. This can result in memory corruption or system instability, particularly on SG-capable UDCs where the dequeue path dereferences the request immediately. The issue is reachable via the FunctionFS device node, typically owned by privileged gadget daemons such as adbd or UMS, meaning a less-privileged service could potentially exploit this if the filesystem is delegated to a non-root daemon.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.