CVE-2026-90045

7.8 Élevée

Publiée le 16/09/2026 à 13:17 · Modifiée le 21/10/2026 à 15:20 · Reçue · Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Description

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling io_data stores a pointer to the submitting task's mm_struct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task exits before completion handling finishes. Take a reference with mmgrab() when queuing the read request and release it with mmdrop() on request completion.

Traduire en français

Produits concernés

Linux

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.8 Élevée	416baaa9-dc9f-4396-8d5f-8c081fb06d67	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Références

https://git.kernel.org/stable/c/1625827648f4e1595ea6ba5521bc87ee5088b32b
https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8
https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0
https://git.kernel.org/stable/c/aee2fde0f39e2b667084f4d5cc323a5c5543d733
https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories