usb: gadget: f_fs: Fix Use-After-Free in AIO error path

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix Use-After-Free in AIO error path In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is freed. However, for AIO operations, the kiocb cancel function was already armed and kiocb->private was set to `p`. If a concurrent cancel operation (such as sys_io_cancel()) executes after ffs_epfile_io() fails but before the function frees `p`, a Use-After-Free can occur when the cancellation handler accesses the freed pointer. To securely fix this race condition, we must properly un-arm the cancellation. Invoking `kiocb->ki_complete()` does exactly this by acquiring `ctx->ctx_lock` and safely removing the kiocb from the active sequence. In doing so, it ensures that a parallel io_cancel can no longer discover the kiocb, effectively closing the race window. We then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been consumed and it should avoid attempting to complete the request again or triggering subsequent completion handlers.

Timeline

1. Sep 16, 2026, 10:33 AM UTCCVE published
2. Oct 21, 2026, 12:49 PM UTCRecord last updated

Affected versions

• Linux Linux

  From de2080d41b5d584205e408d72021f0f335a046fc · fixed in 0a2f71ccf9c2053de725e9a7922d081f3f3a3804; From de2080d41b5d584205e408d72021f0f335a046fc · fixed in b5f0e80a03e87bd932487e03248eae3ba3ed7b45; From de2080d41b5d584205e408d72021f0f335a046fc · fixed in 153b5ecd29ed055562400bc17c91df3fd869b0ce; From de2080d41b5d584205e408d72021f0f335a046fc · fixed in 4a2fb2d12b87b43724230abb52a1440617c7b6cc; From de2080d41b5d584205e408d72021f0f335a046fc · fixed in e78dcb1f7ec271449c54984dc90c62a5ba272de7

• Linux Linux

  4.0

• KernelLinux

  From 4.0.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.51; From 6.19.0 · fixed in 7.2.5

References 5