CVE-2026-90045 Linux CVE debrief

Who should care

Linux kernel developers, maintainers, and users who rely on the Linux kernel's USB gadget function ffs should assess exposure and prioritize patching or mitigation. Linux distributions and users should verify the patched version is applied. Linux kernel developers and maintainers should verify patched versions and assess exposure.

Why it matters

This use-after-free vulnerability in the Linux kernel's USB gadget function ffs can result in a crash or potential code execution if exploited. Linux kernel developers, maintainers, and users should assess exposure and prioritize patching or mitigation.

• Verify patched Linux kernel versions to prevent use-after-free
• Assess exposure of Linux kernel deployments to this vulnerability
• Monitor Linux kernel updates and security advisories for this vulnerability

Technical summary

The Linux kernel's USB gadget function ffs has a use-after-free vulnerability. The io_data stores a pointer to the submitting task's mm_struct without holding a reference to it while async requests are pending. This can result in a use-after-free if the task exits before completion handling finishes. The vulnerability can lead to a crash or potential code execution if exploited. Linux kernel developers and maintainers should assess exposure and prioritize patching or mitigation. Linux distributions and users should verify the patched version is applied.

Defensive priority

Linux kernel developers and maintainers should assess exposure and prioritize patching or mitigation. Linux distributions and users should verify the patched version is applied.

Recommended defensive actions

• Review Linux kernel versions and assess exposure
• Apply patched versions from Linux kernel repositories
• Monitor Linux kernel updates and security advisories
• Verify patched Linux kernel versions to prevent use-after-free
• Assess exposure of Linux kernel deployments to this vulnerability
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Multiple source references from the Linux kernel Git repository are provided. The vulnerability has been resolved in the Linux kernel. Linux kernel developers and maintainers should verify patched versions and assess exposure. The io_data stores a pointer to the submitting task's mm_struct without holding a reference to it while async requests are pending.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.