The Linux kernel vulnerability CVE-2026-64328 concerns a memory leak in the USB gadget f_fs subsystem. In the ffs_dmabuf_transfer() function, a ffs_dma_fence object is allocated and initialized with a reference count of 1. A second reference is added by dma_resv_add_fence(), but the original reference is never released properly. Although ffs_dmabuf_cleanup() decreases the reference count, it only balances with the reference acquired in ffs_dmabuf_signal_done(), leaving the initial reference unreleased. This results in a slow memory leak as more ffs_dma_fence objects accumulate without being freed. The vulnerability was addressed by calling dma_fence_put() immediately after dma_resv_add_fence(), transferring ownership to the DMA reservation object and ensuring the fence is discarded after signaling.

The vulnerability causes a slow memory leak in the Linux kernel's USB gadget subsystem, which could degrade system performance or stability over time due to unreleased dma_fence objects. There is no indication of direct code execution, privilege escalation, or data corruption from this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that a code fix has been implemented to properly release the dma_fence reference. Users should monitor official Linux kernel updates or their distribution's security advisories for patches addressing CVE-2026-64328 and apply them once available.