CVE-2026-90045

Published: Set 16, 2026 Last Modified: Set 17, 2026

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 7,8

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector: local

Attack Complexity: low

Privileges Required: low

User Interaction: none

Scope: unchanged

Confidentiality: high

Integrity: high

Availability: high

AI Translation Available

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: ffs: fix mm lifetime handling

io_data stores a pointer to the submitting task's mm_struct,
but does not currently hold a reference to it while async
requests are pending.

This can result in a use-after-free if the task exits before
completion handling finishes.

Take a reference with mmgrab() when queuing the read request
and release it with mmdrop() on request completion.

https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8

https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0

https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171