CVE-2026-89732 - Vulnerability Details

- usb: gadget: f_fs: Prevent deadlock during ep0 read loop

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Prevent deadlock during ep0 read loop

Currently, ffs_ep0_read() holds ffs->mutex when it prepares to go to
sleep waiting for an event. When no setup events are pending, it calls
wait_event_interruptible_exclusive_locked_irq() with the mutex still
held. The wait macro deliberately drops the waitqueue spinlock before
sleeping but does not drop the mutex.

If a userspace daemon is polling ep0 via read() and the gadget is
asynchronously torn down via configfs (e.g., echo "" > UDC), a
deadlock can occur:

1. The configfs teardown calls functionfs_unbind(), which queues a
FUNCTIONFS_UNBIND event.
2. The daemon wakes up, consumes the event, and drops the mutex.
3. However, if the daemon loops and immediately issues another read()
before exiting, it reacquires ffs->mutex and again goes into an
interruptible sleep.
4. Meanwhile, functionfs_unbind() continues execution and attempts to
acquire ffs->mutex to tear down ep0req.
5. The kernel deadlocks because the configfs thread is stuck in an
uninterruptible sleep waiting for the mutex, while the userspace
daemon is in an interruptible sleep holding the mutex forever
because no more events will arrive.

To fix this, we drop both the waitqueue spinlock and ffs->mutex before
going to sleep, and use wait_event_interruptible_exclusive() instead.
Upon waking up, we jump back to the `retry` label to safely reacquire
the mutex and re-evaluate the state machine. By not sleeping with
ffs->mutex held, we natively decouple gadget teardowns (which require
the mutex) from userspace polling.

Published: 2026-09-11

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The FunctionFS driver in the Linux kernel can enter an interruptible sleep while reading from the control endpoint when ffs->mutex is still held. If a userspace daemon repeatedly reads ep0 while the gadget is being torn down through configfs, the unbinding operation will attempt to acquire the same mutex. Because both sides hold each other’s lock, the kernel deadlocks: the user‑space process is in an interruptible sleep holding the mutex, and the teardown thread waits for the mutex, halting the device and effectively disabling communication. The weakness is identified as CWE‑833.

Affected Systems

All Linux kernel releases that include the FunctionFS gadget driver and are exposed to USB gadget userspace polling are affected. This includes Linux distributions using the default USB gadget stack. Any kernel not patched to the version that contains the fix will remain vulnerable.

Risk and Exploitability

The CVSS score of 4.1 indicates moderate severity, and the EPSS score is below 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local control of a USB gadget device and a userspace process that repeatedly reads the control endpoint during a teardown operation; a successful exploit would cause a deadlock that freezes the device and interrupts service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< fbe3db4b650c284df8eb4cb68eebcf270cf861b5
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< 30430509c156e1df2bdafd5f1cadb160e53db5d6
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< bafddd0f20b5228760be303aa69c58502e92309c
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< b0a6bfac0c3c3edf5b2ecaee87a09234601fe78d
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< fd20cc68bbdb5620696ac108e8f2efd180fe2c1a
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< 34e88f53614640b59039a46717fb6142e9871022
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< eac233e63f9db82ba874e3cccafaafab162999e0
`ddf8abd2599491cbad959c700b90ba72a5dce8d0`	affected	< 569dd7e5dcffe1e1c6b26ca2cd3be57eb433e082

Linux

affected

Version	Status	Constraints
`2.6.35`	affected	—
`0`	unaffected	< 2.6.35
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ddf8abd2599491cbad959c700b90ba72a5dce8d0,fd20cc68bbdb5620696ac108e8f2efd180fe2c1a)`	affected	code_commit	—
`[ddf8abd2599491cbad959c700b90ba72a5dce8d0,34e88f53614640b59039a46717fb6142e9871022)`	affected	code_commit	—
`[ddf8abd2599491cbad959c700b90ba72a5dce8d0,eac233e63f9db82ba874e3cccafaafab162999e0)`	affected	code_commit	—
`[ddf8abd2599491cbad959c700b90ba72a5dce8d0,569dd7e5dcffe1e1c6b26ca2cd3be57eb433e082)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.35`	affected	semver	—
`[0,2.6.35)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a patched version that includes the CVE‑2026‑89732 fix.
Temporarily halt any user‑space polling of ep0 before initiating a gadget teardown via configfs to avoid the deadlock.
Monitor kernel logs for deadlock indicators such as lock acquisition failures and apply the patch promptly when detected.

Generated by OpenCVE AI on September 15, 2026 at 19:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00236.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/30430509c156e1df2bdafd5f1cadb160e53db5d6
https://git.kernel.org/stable/c/34e88f53614640b59039a46717fb6142e9871022
https://git.kernel.org/stable/c/569dd7e5dcffe1e1c6b26ca2cd3be57eb433e082
https://git.kernel.org/stable/c/b0a6bfac0c3c3edf5b2ecaee87a09234601fe78d
https://git.kernel.org/stable/c/bafddd0f20b5228760be303aa69c58502e92309c
https://git.kernel.org/stable/c/eac233e63f9db82ba874e3cccafaafab162999e0
https://git.kernel.org/stable/c/fbe3db4b650c284df8eb4cb68eebcf270cf861b5
https://git.kernel.org/stable/c/fd20cc68bbdb5620696ac108e8f2efd180fe2c1a
https://nvd.nist.gov/vuln/detail/CVE-2026-89732
https://www.cve.org/CVERecord?id=CVE-2026-89732

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/30430509c156e1df2bdafd5f1cadb160e53db5d6 https://git.kernel.org/stable/c/b0a6bfac0c3c3edf5b2ecaee87a09234601fe78d https://git.kernel.org/stable/c/bafddd0f20b5228760be303aa69c58502e92309c https://git.kernel.org/stable/c/fbe3db4b650c284df8eb4cb68eebcf270cf861b5

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89732 https://www.cve.org/CVERecord?id=CVE-2026-89732
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Prevent deadlock during ep0 read loop Currently, ffs_ep0_read() holds ffs->mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls wait_event_interruptible_exclusive_locked_irq() with the mutex still held. The wait macro deliberately drops the waitqueue spinlock before sleeping but does not drop the mutex. If a userspace daemon is polling ep0 via read() and the gadget is asynchronously torn down via configfs (e.g., echo "" > UDC), a deadlock can occur: 1. The configfs teardown calls functionfs_unbind(), which queues a FUNCTIONFS_UNBIND event. 2. The daemon wakes up, consumes the event, and drops the mutex. 3. However, if the daemon loops and immediately issues another read() before exiting, it reacquires ffs->mutex and again goes into an interruptible sleep. 4. Meanwhile, functionfs_unbind() continues execution and attempts to acquire ffs->mutex to tear down ep0req. 5. The kernel deadlocks because the configfs thread is stuck in an uninterruptible sleep waiting for the mutex, while the userspace daemon is in an interruptible sleep holding the mutex forever because no more events will arrive. To fix this, we drop both the waitqueue spinlock and ffs->mutex before going to sleep, and use wait_event_interruptible_exclusive() instead. Upon waking up, we jump back to the `retry` label to safely reacquire the mutex and re-evaluate the state machine. By not sleeping with ffs->mutex held, we natively decouple gadget teardowns (which require the mutex) from userspace polling.
Title		usb: gadget: f_fs: Prevent deadlock during ep0 read loop
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/34e88f53614640b59039a46717fb6142e9871022 https://git.kernel.org/stable/c/569dd7e5dcffe1e1c6b26ca2cd3be57eb433e082 https://git.kernel.org/stable/c/eac233e63f9db82ba874e3cccafaafab162999e0 https://git.kernel.org/stable/c/fd20cc68bbdb5620696ac108e8f2efd180fe2c1a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:41.974Z

Updated: 2026-09-14T12:02:20.311Z

Reserved: 2026-09-11T19:38:34.760Z

Link: CVE-2026-89732

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:20:03.600

Modified: 2026-09-14T13:19:22.293

Link: CVE-2026-89732

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:46:41Z

Links: CVE-2026-89732 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T20:00:08Z

Weaknesses

CWE-833
Deadlock

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object