CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's USB gadget subsystem, specifically in the `ffs_dmabuf_transfer()` function, where improper error handling can lead to undefined behavior due to uninitialized fence objects. This flaw arises when the system attempts to release a DMA fence that has not been properly initialized, potentially leading to memory corruption or crashes. Organizations utilizing Linux-based systems, particularly those leveraging USB gadget functionality, should prioritize addressing this issue to maintain system stability and security.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths The error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM) in ffs_dmabuf_transfer() jump to err_fence_put which calls dma_fence_put() on the fence. However, at that point the fence has only been kmalloc'd — dma_fence_init() has not been called yet, so the refcount and the fence ops are uninitialized. Calling dma_fence_put() on such an object leads to undefined behavior. Use kfree() instead, since the fence is just a plain allocation at this stage, and rename the label to err_fence_free to reflect the actual cleanup action.