{"id":"CVE-2026-64328","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix DMA fence leak\n\nIn ffs_dmabuf_transfer(), a ffs_dma_fence object is kmalloc'd, with the\nunderlying dma_fence later initialized by dma_fence_init(…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix DMA fence leak\n\nIn ffs_dmabuf_transfer(), a ffs_dma_fence object is kmalloc'd, with the\nunderlying dma_fence later initialized by dma_fence_init(…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-401"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.9, < 6.12.96","linux_kernel >= 6.13, < 6.18.39","linux_kernel >= 6.19, < 7.1.4","linux_kernel = 7.2"],"patched":["linux_kernel 7.1.4"],"published":"2026-07-25","updated":"2026-09-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64328","references":[{"url":"https://git.kernel.org/stable/c/0cae3d6109427c455bad0a18dfb3e2a91657e38a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b7475b2dce5e121e687280ba5732ccefe77ffd2f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/baa6b6068a3f2bf2ed525a1cb37975905dadc658","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e086c16962a1b0142e2675610e9c06fcfcd4c3a8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00159,"epssPercentile":0.05489,"ingestedAt":"2026-09-05T13:39:56.289Z","slug":"CVE-2026-64328","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix DMA fence leak\n\nIn ffs_dmabuf_transfer(), a ffs_dma_fence object is kmalloc'd, with the\nunderlying dma_fence later initialized by dma_fence_init(), which sets\nits kref counter to 1. Then, dma_resv_add_fence() gets a second\nreference, and a pointer to the ffs_dma_fence is passed as the\nusb_request's \"context\" field.\n\nThe dma-resv mechanism will manage the second reference, but the first\nreference is never properly released; the ffs_dmabuf_cleanup() function\ndecreases the reference count, but only to balance with the reference\ngrab in ffs_dmabuf_signal_done().\n\nThe code will then slowly leak memory as more ffs_dma_fence objects are\ncreated without being ever freed.\n\nAddress this issue by transferring ownership of the fence to the DMA\nreservation object, by calling dma_fence_put() right after\ndma_resv_add_fence(). The ffs_dma_fence then gets properly discarded\nafter being signalled.\n\n## Affected\n\n- `linux_kernel >= 6.9, < 6.12.96`\n- `linux_kernel >= 6.13, < 6.18.39`\n- `linux_kernel >= 6.19, < 7.1.4`\n- `linux_kernel = 7.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.1.4`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}