A memory corruption vulnerability in the Linux kernel USB gadget driver could allow a local attacker to trigger undefined behavior, potentially leading to system instability or privilege escalation.

The flaw exists in the ffs_dmabuf_transfer function, where error paths incorrectly call dma_fence_put on an uninitialized fence object. This occurs because the object is only allocated via kmalloc and has not yet been initialized by dma_fence_init, requiring a local user with low privileges to trigger the specific error path.

The vulnerability carries a CVSS score of 7.0, classifying it as High severity. While the attack vector is local, the potential for undefined behavior in the kernel can result in system crashes, denial of service, or unauthorized memory access, which may facilitate further exploitation to gain elevated privileges. Organizations relying on Linux-based appliances or workstations should treat this as a significant stability and security risk.

Immediate Action: Update your Linux kernel to version 6.12.110, 6.18.52, 7.2.6, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages associated with USB subsystem activity, which may indicate attempted exploitation of this memory management error.

Compensating Controls: Restrict access to USB gadgets and physical device interfaces for untrusted local users to reduce the attack surface for this kernel-level flaw.

Public Exploit Available: No

Given the high severity of kernel-level vulnerabilities, administrators should prioritize patching as soon as stable kernel packages are released by their respective distributions. While the requirement for local access and specific error conditions limits immediate risk, kernel stability is critical to overall system security and integrity.