---
id: CVE-2026-80854
title: 'usb: gadget: f_tcm: keep port count until LUN teardown completes'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: gadget: f_tcm: keep port count until LUN teardown completes

  tcm_usbg_drop_nexus() permits session removal once tpg_port_count
  reaches zero. However, usbg_port_unl…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c52661d60f636d17e26ad834457db333bd1df494 <
    c494c5562ca69b61a82f566e3b87a445d2c28929
  - >-
    Linux >= c52661d60f636d17e26ad834457db333bd1df494 <
    c1f359d9a5efed458946063de65ddbeaacc4f165
  - >-
    Linux >= c52661d60f636d17e26ad834457db333bd1df494 <
    178f59a0bccd3f66cdfa5184310f31a58b7257c4
  - >-
    Linux >= c52661d60f636d17e26ad834457db333bd1df494 <
    ad6f0375d2e93a1d8c015463e5e92dfcb26e311b
  - >-
    Linux >= c52661d60f636d17e26ad834457db333bd1df494 <
    2efbfd42441d3ef8137aff2d59e9835e1d5ae780
  - >-
    Linux >= c52661d60f636d17e26ad834457db333bd1df494 <
    85aa61fedcb4eb13f3dc5db73f6dc359f41f5d95
  - >-
    Linux >= c52661d60f636d17e26ad834457db333bd1df494 <
    bbd6aa311a9f4dd17822c7557451458d3d2e980b
  - >-
    Linux >= c52661d60f636d17e26ad834457db333bd1df494 <
    eaa96a8458f54d6cf0954242ab8b1df2a6fccafa
  - >-
    Linux >= c52661d60f636d17e26ad834457db333bd1df494 <
    c39d0916da47d94909391876c9e5bd429ea7b1b9
  - Linux 3.5
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:44:48.320Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80854'
references:
  - url: 'https://git.kernel.org/stable/c/c494c5562ca69b61a82f566e3b87a445d2c28929'
  - url: 'https://git.kernel.org/stable/c/c1f359d9a5efed458946063de65ddbeaacc4f165'
  - url: 'https://git.kernel.org/stable/c/178f59a0bccd3f66cdfa5184310f31a58b7257c4'
  - url: 'https://git.kernel.org/stable/c/ad6f0375d2e93a1d8c015463e5e92dfcb26e311b'
  - url: 'https://git.kernel.org/stable/c/2efbfd42441d3ef8137aff2d59e9835e1d5ae780'
  - url: 'https://git.kernel.org/stable/c/85aa61fedcb4eb13f3dc5db73f6dc359f41f5d95'
  - url: 'https://git.kernel.org/stable/c/bbd6aa311a9f4dd17822c7557451458d3d2e980b'
  - url: 'https://git.kernel.org/stable/c/eaa96a8458f54d6cf0954242ab8b1df2a6fccafa'
  - url: 'https://git.kernel.org/stable/c/c39d0916da47d94909391876c9e5bd429ea7b1b9'
tags:
  - cve.org
epss: 0.00182
epssPercentile: 0.07249
ingestedAt: '2026-10-19T09:16:01.494Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_tcm: keep port count until LUN teardown completes

tcm_usbg_drop_nexus() permits session removal once tpg_port_count
reaches zero. However, usbg_port_unlink() currently decrements that
count from the fabric_pre_unlink() callback, before core_dev_del_lun()
waits for active se_lun references to drain.

If removal of the last LUN races a nexus removal, the latter can observe
a zero port count and call target_remove_session(). This frees
sess_cmd_map while an in-flight struct usbg_cmd, including its work item,
can still be accessed.

Overlapping the last-LUN unlink with nexus removal reproduces this
lifetime violation as a DEBUG_OBJECTS "free active" warning for
usbg_cmd_work, followed by a target-core BUG/Oops.

The generic target-core unlink path has no callback after
core_dev_del_lun() completes. Add an optional fabric_post_unlink()
callback and use it for the f_tcm port count. The count now remains
nonzero until core_dev_del_lun() has finished draining active LUN
references, preventing nexus removal from freeing the session during
command completion.

## Affected

- `Linux >= c52661d60f636d17e26ad834457db333bd1df494 < c494c5562ca69b61a82f566e3b87a445d2c28929`
- `Linux >= c52661d60f636d17e26ad834457db333bd1df494 < c1f359d9a5efed458946063de65ddbeaacc4f165`
- `Linux >= c52661d60f636d17e26ad834457db333bd1df494 < 178f59a0bccd3f66cdfa5184310f31a58b7257c4`
- `Linux >= c52661d60f636d17e26ad834457db333bd1df494 < ad6f0375d2e93a1d8c015463e5e92dfcb26e311b`
- `Linux >= c52661d60f636d17e26ad834457db333bd1df494 < 2efbfd42441d3ef8137aff2d59e9835e1d5ae780`
- `Linux >= c52661d60f636d17e26ad834457db333bd1df494 < 85aa61fedcb4eb13f3dc5db73f6dc359f41f5d95`
- `Linux >= c52661d60f636d17e26ad834457db333bd1df494 < bbd6aa311a9f4dd17822c7557451458d3d2e980b`
- `Linux >= c52661d60f636d17e26ad834457db333bd1df494 < eaa96a8458f54d6cf0954242ab8b1df2a6fccafa`
- `Linux >= c52661d60f636d17e26ad834457db333bd1df494 < c39d0916da47d94909391876c9e5bd429ea7b1b9`
- `Linux 3.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.