{"id":"CVE-2026-90045","published":"2026-09-16T11:17:17.763","lastModified":"2026-09-21T14:17:28.670","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: ffs: fix mm lifetime handling\n\nio_data stores a pointer to the submitting task's mm_struct,\nbut does not currently hold a reference to it while async\nrequests are pending.\n\nThis can result in a use-after-free if the task exits before\ncompletion handling finishes.\n\nTake a reference with mmgrab() when queuing the read request\nand release it with mmdrop() on request completion.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/1625827648f4e1595ea6ba5521bc87ee5088b32b","tags":[]},{"url":"https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8","tags":[]},{"url":"https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0","tags":[]},{"url":"https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}