{"id":"CVE-2026-90045","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: ffs: fix mm lifetime handling\n\nio_data stores a pointer to the submitting task's mm_struct,\nbut does not currently hold a reference to it while async\nreque…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: ffs: fix mm lifetime handling\n\nio_data stores a pointer to the submitting task's mm_struct,\nbut does not currently hold a reference to it while async\nreque…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f3d31484b3f26d63c09e5569ebfaa1079a17f171","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7411de0ce3b45286de1de82526795658ea6eacb0","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8","Linux < 6.18.51","Linux < 7.2.5","Linux (all versions)"],"published":"2026-09-16","updated":"2026-09-21","sourceUpdated":"2026-09-21T14:17:28.670","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90045","references":[{"url":"https://git.kernel.org/stable/c/1625827648f4e1595ea6ba5521bc87ee5088b32b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00148,"epssPercentile":0.04397,"ingestedAt":"2026-09-16T10:53:53.931Z","slug":"CVE-2026-90045","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: ffs: fix mm lifetime handling\n\nio_data stores a pointer to the submitting task's mm_struct,\nbut does not currently hold a reference to it while async\nrequests are pending.\n\nThis can result in a use-after-free if the task exits before\ncompletion handling finishes.\n\nTake a reference with mmgrab() when queuing the read request\nand release it with mmdrop() on request completion.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":204980,"id":"CVE-2026-90045","ts":1789570701021,"field":"cvss","old":null,"new":"7.8"},{"seq":204979,"id":"CVE-2026-90045","ts":1789570701021,"field":"severity","old":"none","new":"high"}]}