HIGH Introduced in 6.9
f_fs DmaFence Deref
CVE-2026-93121
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths The error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM) in ffs_dmabuf_transfer() jump to err_fence_put which calls dma_fence_put() on the fence. However, at that point the fence has only been kmalloc'd — dma_fence_init() has not been called yet, so the refcount and the fence ops are uninitialized. Calling dma_fence_put() on such an object leads to undefined behavior. Use kfree() instead, since the fence is just a plain allocation at this stage, and rename the label to err_fence_free to reflect the actual cleanup action.
02KernelScan AI Analysis
Risk summary
A local process with access to a USB gadget FunctionFS endpoint file descriptor can trigger undefined behavior by invoking the DMABUF transfer ioctl under error conditions. The error cleanup path operates on a fence object that was allocated but never initialized, dereferencing uninitialized memory that may contain stale function pointers. This can crash the kernel or, with heap grooming, potentially achieve code execution.
Vulnerability analysis
In the USB gadget FunctionFS driver, when a DMABUF transfer fails early because the endpoint is disabled while the operation is starting or because a request allocation fails, the cleanup code treats a freshly allocated fence object as if it were fully initialized. Because the object's reference count and function pointers were never set up, the cleanup step dereferences uninitialized memory. This causes undefined behavior that typically crashes the kernel, but if an attacker can influence the contents of the memory slab, it could lead to arbitrary code execution. The correct behavior is to free the raw allocation, since the object was never initialized beyond the initial allocation. A local process with access to an open FunctionFS endpoint can trigger the bug by starting a DMABUF transfer; the endpoint-disabled case requires a race with another operation that disables the endpoint.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.9 | 6.12.110 | be539138d9a1 |
| 6.18 | 6.9 | 6.18.52 | 5fd8baacc7dc |
| 7.2 | 6.9 | 7.2.6 | 58952c83dfe6 |
| mainline | 6.9 | 7.3 | 621707dc67c9 |
| cip/6.12 | 6.9 | 6.12.111-cip32 | be539138d9a1 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |