CVE-2026-64594
Received Received - Intake

USB Gadget FunctionFS Reset Work Initialization Flaw

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: initialize reset_work at allocation time ffs_fs_kill_sb() unconditionally calls cancel_work_sync() on ffs->reset_work when a functionfs instance is unmounted: ffs_data_reset(ffs); cancel_work_sync(&ffs->reset_work); However ffs->reset_work is only ever initialized via INIT_WORK() in ffs_func_set_alt() and ffs_func_disable(), and only on the FFS_DEACTIVATED path. That state is reached solely by ffs_data_closed() when the instance is mounted with the "no_disconnect" option, so for the common case (no "no_disconnect", or mounted and unmounted without ever being deactivated) reset_work is never initialized. ffs_data_new() allocates the ffs_data with kzalloc_obj() and does not initialize reset_work, and ffs_data_reset()/ffs_data_clear() do not touch it either, so reset_work.func is left NULL. cancel_work_sync() on such a work then trips the WARN_ON(!work->func) guard in __flush_work(): WARNING: kernel/workqueue.c:4301 at __flush_work+0x330/0x360, CPU#3: umount Call trace: __flush_work cancel_work_sync ffs_fs_kill_sb [usb_f_fs] deactivate_locked_super deactivate_super cleanup_mnt __cleanup_mnt task_work_run exit_to_user_mode_loop el0_svc On older kernels cancel_work_sync() on a zero-initialized work struct was a silent no-op, which hid the missing initialization. Initialize reset_work once in ffs_data_new() so it is always valid for the lifetime of the ffs_data, and drop the now-redundant INIT_WORK() calls from the two deactivation paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-64594
EUVD
EUVD-2026-53781

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where the reset_work structure in the USB gadget function filesystem (f_fs) is not properly initialized. When unmounting a functionfs instance, the kernel attempts to cancel reset_work using cancel_work_sync(), but reset_work.func is NULL because it was never initialized. This triggers a kernel warning in __flush_work() due to the NULL function pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB gadget function filesystem (f_fs) and may not have direct network detection methods. Check kernel logs for warnings related to workqueue operations or USB gadget subsystem errors, such as 'WARNING: kernel/workqueue.c:4301 at __flush_work' or 'cancel_work_sync' traces.

Impact Analysis

This vulnerability causes a kernel warning message during unmount operations of USB gadget functionfs instances. While it does not directly lead to security exploits or data loss, it may indicate instability or improper cleanup in the kernel's USB gadget subsystem. Users might see warning messages in system logs during normal operations.

Mitigation Strategies

Apply the latest kernel patches or updates that include the fix for this issue. Monitor kernel logs for related errors and ensure USB gadget functionality is not critical if unpatched. Reboot the system after applying patches to ensure changes take effect.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64594. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart