Threats tagged 'ghsa-g8pp-pjx5-c2hv'

CVE-2026-90045 is a use-after-free vulnerability in the Linux kernel's USB gadget function filesystem (ffs) related to improper memory management of the submitting task's mm_struct during asynchronous requests. The flaw occurs because the kernel does not hold a reference to the mm_struct while async requests are pending, which can lead to use-after-free if the task exits prematurely. This vulnerability has been fixed by taking a reference with mmgrab() when queuing the read request and releasing it with mmdrop() upon completion.