CVE-2026-90044

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free issue exists in the USB gadget functionfs module. In the ffs epfile write iter() and ffs epfile read iter() functions, when ffs epfile io() fails with an error other than -EIOCBQUEUED, the p structure (io data) is freed. However, for Asynchronous I/O (AIO) operations, the kiocb cancel function is already armed and kiocb->private is set to p. A race condition occurs if a concurrent cancel operation, such as sys io cancel(), executes after ffs epfile io() fails but before p is freed, leading to a Use-After-Free when the cancellation handler accesses the freed pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.