---
id: CVE-2026-64328
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: gadget: f_fs: Fix DMA fence leak

  In ffs_dmabuf_transfer(), a ffs_dma_fence object is kmalloc'd, with the
  underlying dma_fence later initialized by dma_fence_init(…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: gadget: f_fs: Fix DMA fence leak

  In ffs_dmabuf_transfer(), a ffs_dma_fence object is kmalloc'd, with the
  underlying dma_fence later initialized by dma_fence_init(…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-401
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.9, < 6.12.96'
  - 'linux_kernel >= 6.13, < 6.18.39'
  - 'linux_kernel >= 6.19, < 7.1.4'
  - linux_kernel = 7.2
patched:
  - linux_kernel 7.1.4
published: '2026-07-25'
updated: '2026-09-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64328'
references:
  - url: 'https://git.kernel.org/stable/c/0cae3d6109427c455bad0a18dfb3e2a91657e38a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b7475b2dce5e121e687280ba5732ccefe77ffd2f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/baa6b6068a3f2bf2ed525a1cb37975905dadc658'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e086c16962a1b0142e2675610e9c06fcfcd4c3a8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00159
epssPercentile: 0.04319
ingestedAt: '2026-09-05T13:39:56.289Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Fix DMA fence leak

In ffs_dmabuf_transfer(), a ffs_dma_fence object is kmalloc'd, with the
underlying dma_fence later initialized by dma_fence_init(), which sets
its kref counter to 1. Then, dma_resv_add_fence() gets a second
reference, and a pointer to the ffs_dma_fence is passed as the
usb_request's "context" field.

The dma-resv mechanism will manage the second reference, but the first
reference is never properly released; the ffs_dmabuf_cleanup() function
decreases the reference count, but only to balance with the reference
grab in ffs_dmabuf_signal_done().

The code will then slowly leak memory as more ffs_dma_fence objects are
created without being ever freed.

Address this issue by transferring ownership of the fence to the DMA
reservation object, by calling dma_fence_put() right after
dma_resv_add_fence(). The ffs_dma_fence then gets properly discarded
after being signalled.

## Affected

- `linux_kernel >= 6.9, < 6.12.96`
- `linux_kernel >= 6.13, < 6.18.39`
- `linux_kernel >= 6.19, < 7.1.4`
- `linux_kernel = 7.2`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.1.4`