Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-90045 Details

Description

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling io_data stores a pointer to the submitting task's mm_struct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task exits before completion handling finishes. Take a reference with mmgrab() when queuing the read request and release it with mmdrop() on request completion.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: kernel.orgCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/1625827648f4e1595ea6ba5521bc87ee5088b32b kernel.org
https://git.kernel.org/stable/c/5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8 kernel.org
https://git.kernel.org/stable/c/7411de0ce3b45286de1de82526795658ea6eacb0 kernel.org
https://git.kernel.org/stable/c/f3d31484b3f26d63c09e5569ebfaa1079a17f171 kernel.org

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

4 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-90045
NVD Published Date:
Sep 16, 2026
NVD Last Modified:
Sep 21, 2026
Source:
kernel.org
CVE-2026-90045 Details - Not Deferred