{"id":"CVE-2026-90045","published":"2026-09-16T11:17:17.763","lastModified":"2026-09-21T14:17:28.670","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: ffs: fix mm lifetime handling\n\nio_data stores a pointer to the submitting task's mm_struct,\nbut does not currently hold a reference to it while async\nrequests are pending.\n\nThis can result in a use-after-free if the task exits before\ncompletion handling finishes.\n\nTake a reference with mmgrab() when queuing the read request\nand release it with mmdrop() on request completion.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/1625827648f4e1595ea6ba5521bc87ee5088b32b","tags":[]},{"url":"https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8","tags":[]},{"url":"https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0","tags":[]},{"url":"https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw involves improper management of memory references in USB gadget ffs, leading to potential use-after-free conditions if a task exits prematurely during asynchronous request handling.","exploitability":"Exploitation requires the task to exit before completion handling, making it moderately difficult. Precondition is the presence of a task that can be controlled to exit at a specific time.","blast_radius":"If exploited, this could lead to arbitrary code execution or system instability, impacting the integrity and availability of the system.","remediation":"Upgrade to the specific version 5.10.100 or later, as published in the advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["use-after-free","kernel","usb","memory-management"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:45:23.353Z"}}