CVE-2026-64328

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Fix DMA fence leak

In ffsdmabuftransfer(), a ffsdmafence object is kmalloc'd, with the underlying dmafence later initialized by dmafenceinit(), which sets its kref counter to 1. Then, dmaresvaddfence() gets a second reference, and a pointer to the ffsdmafence is passed as the usb_request's "context" field.

The dma-resv mechanism will manage the second reference, but the first reference is never properly released; the ffsdmabufcleanup() function decreases the reference count, but only to balance with the reference grab in ffsdmabufsignal_done().

The code will then slowly leak memory as more ffsdmafence objects are created without being ever freed.

Address this issue by transferring ownership of the fence to the DMA reservation object, by calling dmafenceput() right after dmaresvaddfence(). The ffsdma_fence then gets properly discarded after being signalled.