CVE-2026-64328

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: f_fs: Fix DMA fence leak<br /> <br /> In ffs_dmabuf_transfer(), a ffs_dma_fence object is kmalloc&amp;#39;d, with the<br /> underlying dma_fence later initialized by dma_fence_init(), which sets<br /> its kref counter to 1. Then, dma_resv_add_fence() gets a second<br /> reference, and a pointer to the ffs_dma_fence is passed as the<br /> usb_request&amp;#39;s "context" field.<br /> <br /> The dma-resv mechanism will manage the second reference, but the first<br /> reference is never properly released; the ffs_dmabuf_cleanup() function<br /> decreases the reference count, but only to balance with the reference<br /> grab in ffs_dmabuf_signal_done().<br /> <br /> The code will then slowly leak memory as more ffs_dma_fence objects are<br /> created without being ever freed.<br /> <br /> Address this issue by transferring ownership of the fence to the DMA<br /> reservation object, by calling dma_fence_put() right after<br /> dma_resv_add_fence(). The ffs_dma_fence then gets properly discarded<br /> after being signalled.