CVE-2026-90044 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators of systems utilizing the affected USB gadget functionality should assess exposure and prioritize verification of affected systems.

Why it matters

CVE-2026-90044 is a Use-After-Free vulnerability in the Linux kernel's USB gadget function f_fs. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems.

• Verification of Linux kernel versions and system configurations is necessary to determine exposure.
• Potential for Use-After-Free vulnerability exploitation requires immediate attention from Linux kernel maintainers and users.
• Applying patches or updates from the Linux kernel maintainers may be necessary to mitigate the vulnerability.

Technical summary

The vulnerability is caused by a race condition in the f_fs USB gadget function of the Linux kernel. When ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure is freed. However, if a concurrent cancel operation executes after ffs_epfile_io() fails but before the function frees the io_data, a Use-After-Free can occur when the cancellation handler accesses the freed pointer.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems.

Recommended defensive actions

• Review Linux kernel versions for potential exposure
• Verify system configurations for affected USB gadget functionality
• Consider applying patches or updates from the Linux kernel maintainers
• Perform vulnerability scanning to identify potentially affected systems
• Implement monitoring to detect potential exploitation attempts
• Maintain an inventory of assets that may be affected
• Establish a rollback plan for changes related to mitigation

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems. The vulnerability is caused by a race condition in the f_fs USB gadget function of the Linux kernel. When ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure is freed. However, if a concurrent cancel operation executes after ffs_epfile_io() fails but before the function frees the io_data, a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.