Improper Initialization in Linux Kernel USB Gadget by Linux Foundation

CVE-2026-64594

What is CVE-2026-64594?

In the Linux kernel, a vulnerability in the USB gadget subsystem was identified where the reset_work was not initialized properly during allocation. The issue occurs in the function fs implementation, specifically in the ffs_data_new function. When an instance is unmounted, the cancel_work_sync function may be called on a not-yet-initialized work struct, leading to warnings in the kernel log due to null function pointers. This vulnerability was silently bypassed in earlier kernel versions but has since been fixed by ensuring that the reset_work is initialized correctly at creation time.

References