CVE-2026-64328 describes a memory leak vulnerability in the Linux kernel's USB gadget subsystem (f_fs). In the function ffs_dmabuf_transfer(), a ffs_dma_fence object is allocated and initialized with a reference count of one. A second reference is added by dma_resv_add_fence(), but the original reference is never released properly. The cleanup function only balances references related to signaling, leaving the initial reference unreleased. This causes a slow memory leak as more ffs_dma_fence objects accumulate without being freed. The vulnerability is addressed by calling dma_fence_put() immediately after dma_resv_add_fence(), transferring ownership to the DMA reservation object and ensuring proper disposal after signaling.

The vulnerability causes a slow memory leak in the Linux kernel's USB gadget function, which can lead to increased memory consumption over time. There is no indication of direct code execution or privilege escalation from this issue. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel source code that properly releases the dma_fence reference by calling dma_fence_put() after dma_resv_add_fence(). Users should apply the official kernel update or patch that includes this fix once available. Patch status is not yet confirmed—check the vendor advisory or Linux kernel mailing lists for current remediation guidance.