CVE-2026-80854

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_tcm: keep port count until LUN teardown completes

tcmusbgdropnexus() permits session removal once tpgportcount reaches zero. However, usbgportunlink() currently decrements that count from the fabricpreunlink() callback, before coredevdellun() waits for active se_lun references to drain.

If removal of the last LUN races a nexus removal, the latter can observe a zero port count and call targetremovesession(). This frees sesscmdmap while an in-flight struct usbg_cmd, including its work item, can still be accessed.

Overlapping the last-LUN unlink with nexus removal reproduces this lifetime violation as a DEBUGOBJECTS "free active" warning for usbgcmd_work, followed by a target-core BUG/Oops.

The generic target-core unlink path has no callback after coredevdellun() completes. Add an optional fabricpostunlink() callback and use it for the ftcm port count. The count now remains nonzero until coredevdel_lun() has finished draining active LUN references, preventing nexus removal from freeing the session during command completion.