CVE-2026-63894

A flaw was found in the Linux kernel's FunctionFS (f_fs) component. A race condition exists where a Direct Memory Access Buffer (DMABUF) cancel operation can occur concurrently with a request completion, leading to a use-after-free vulnerability. This allows a privileged local attacker, such as a compromised gadget daemon, to potentially cause a system crash (denial of service) or execute arbitrary code due to the reuse of freed memory.

This flaw is evaluated as having Moderate impact because successful exploitation requires local access with elevated privileges to interact with FunctionFS endpoints and depends on winning a precise timing window. USB gadget configurations are not active in standard enterprise installations, which significantly limits potential exposure. Furthermore, Red Hat Enterprise Linux kernels do not include the underlying code supporting DMABUF transfers in FunctionFS and are therefore not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.