The Linux kernel's usb gadget function filesystem (functionfs) had a flaw where the reset_work workqueue item was not always initialized when a functionfs instance was unmounted. Specifically, ffs_fs_kill_sb() calls cancel_work_sync() on reset_work unconditionally, but reset_work was only initialized in certain deactivation paths. In common cases, reset_work remained uninitialized, causing cancel_work_sync() to trigger a kernel warning due to a NULL function pointer. The patch initializes reset_work at allocation time in ffs_data_new(), ensuring it is always valid for the lifetime of the ffs_data structure and removing redundant initializations in deactivation paths.

This vulnerability could cause kernel warnings and potentially unstable behavior during unmount operations of functionfs instances, due to cancel_work_sync() being called on an uninitialized work struct. While this does not indicate direct code execution or privilege escalation, it may lead to kernel instability or crashes in affected systems.

A fix has been implemented that initializes reset_work at allocation time in the Linux kernel source code. Users should update to a Linux kernel version that includes this patch once available. Patch status is not yet confirmed — check the vendor advisory or Linux kernel mailing lists for the current remediation guidance.