PT-2026-64549 · Linux · Linux
CVE-2026-64328
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f fs: Fix DMA fence leak
In ffs dmabuf transfer(), a ffs dma fence object is kmalloc'd, with the
underlying dma fence later initialized by dma fence init(), which sets
its kref counter to 1. Then, dma resv add fence() gets a second
reference, and a pointer to the ffs dma fence is passed as the
usb request's "context" field.
The dma-resv mechanism will manage the second reference, but the first
reference is never properly released; the ffs dmabuf cleanup() function
decreases the reference count, but only to balance with the reference
grab in ffs dmabuf signal done().
The code will then slowly leak memory as more ffs dma fence objects are
created without being ever freed.
Address this issue by transferring ownership of the fence to the DMA
reservation object, by calling dma fence put() right after
dma resv add fence(). The ffs dma fence then gets properly discarded
after being signalled.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux