CVE-2026-90045

HighCVSS 7.8/10Last modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: ffs: fix mm lifetime handling

io_data stores a pointer to the submitting task's mm_struct, but does not currently hold a reference to it while async requests are pending.

This can result in a use-after-free if the task exits before completion handling finishes.

Take a reference with mmgrab() when queuing the read request and release it with mmdrop() on request completion.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 16, 2026
Last modified
Oct 30, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-900467.8In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: don't spin_trylock() in NMI on UP Patch series "mm/pageCVE-2026-900477.8In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't hand out the flat CCS storage as usable VRAM get_flat_ccCVE-2026-900489.8In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() ni_creCVE-2026-900499.3In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() skbCVE-2026-900517.8In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without CVE-2026-90053In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_htb: limit htb_classify inner-class filter hops htb_claCVE-2026-90054In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the CVE-2026-90055In the Linux kernel, the following vulnerability has been resolved: usb: atm: usbatm: fix invalid ci_range initialization syzbot reported CVE-2026-90056In the Linux kernel, the following vulnerability has been resolved: net: fec: only stop PTP if it was initialized fec_ptp_init() is only cCVE-2026-900577.8In the Linux kernel, the following vulnerability has been resolved: slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() CVE-2026-90058In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup qdisc_get_CVE-2026-900597.5In the Linux kernel, the following vulnerability has been resolved: net: stmmac: restore NET_IP_ALIGN in the RX DMA offset Since the RX pa
CVE-2026-90045: High severity, CVSS 7.8 | Vulnix