PT-2026-64549 · Linux · Linux

CVE-2026-64328

·

Publicado

2026-07-25

·

Atualizado

2026-07-25

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f fs: Fix DMA fence leak
In ffs dmabuf transfer(), a ffs dma fence object is kmalloc'd, with the underlying dma fence later initialized by dma fence init(), which sets its kref counter to 1. Then, dma resv add fence() gets a second reference, and a pointer to the ffs dma fence is passed as the usb request's "context" field.
The dma-resv mechanism will manage the second reference, but the first reference is never properly released; the ffs dmabuf cleanup() function decreases the reference count, but only to balance with the reference grab in ffs dmabuf signal done().
The code will then slowly leak memory as more ffs dma fence objects are created without being ever freed.
Address this issue by transferring ownership of the fence to the DMA reservation object, by calling dma fence put() right after dma resv add fence(). The ffs dma fence then gets properly discarded after being signalled.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64328

Produtos afetados

Linux