CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: initialize reset_work at allocation time

ffs_fs_kill_sb() unconditionally calls cancel_work_sync() on
ffs->reset_work when a functionfs instance is unmounted:

	ffs_data_reset(ffs);
	cancel_work_sync(&ffs->reset_work);

However ffs->reset_work is only ever initialized via INIT_WORK() in
ffs_func_set_alt() and ffs_func_disable(), and only on the
FFS_DEACTIVATED path. That state is reached solely by ffs_data_closed()
when the instance is mounted with the "no_disconnect" option, so for the
common case (no "no_disconnect", or mounted and unmounted without ever
being deactivated) reset_work is never initialized.

ffs_data_new() allocates the ffs_data with kzalloc_obj() and does not
initialize reset_work, and ffs_data_reset()/ffs_data_clear() do not touch
it either, so reset_work.func is left NULL. cancel_work_sync() on such a
work then trips the WARN_ON(!work->func) guard in __flush_work():

  WARNING: kernel/workqueue.c:4301 at __flush_work+0x330/0x360, CPU#3: umount
  Call trace:
   __flush_work
   cancel_work_sync
   ffs_fs_kill_sb [usb_f_fs]
   deactivate_locked_super
   deactivate_super
   cleanup_mnt
   __cleanup_mnt
   task_work_run
   exit_to_user_mode_loop
   el0_svc

On older kernels cancel_work_sync() on a zero-initialized work struct was
a silent no-op, which hid the missing initialization.

Initialize reset_work once in ffs_data_new() so it is always valid for
the lifetime of the ffs_data, and drop the now-redundant INIT_WORK()
calls from the two deactivation paths.

The Linux kernel CVE team has assigned CVE-2026-64594 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.0 with commit 18d6b32fca3841f7cd9479b4024abd8a9b299281 and fixed in 5.10.261 with commit 7fe895e0a9651518c4fc082487da770ff9c14c7f
	Issue introduced in 4.0 with commit 18d6b32fca3841f7cd9479b4024abd8a9b299281 and fixed in 5.15.212 with commit 0de6ebbabfbbc9c28350283dc97d8a519d5c6dd7
	Issue introduced in 4.0 with commit 18d6b32fca3841f7cd9479b4024abd8a9b299281 and fixed in 6.1.178 with commit cb19e54ebe9baf3c3243083ade65c937339ccb7b
	Issue introduced in 4.0 with commit 18d6b32fca3841f7cd9479b4024abd8a9b299281 and fixed in 6.6.145 with commit d5631081be07f20e764d3cb5c98ac0a1004fba51
	Issue introduced in 4.0 with commit 18d6b32fca3841f7cd9479b4024abd8a9b299281 and fixed in 6.12.97 with commit c36393b0d14e1e9783888f821ffe29381b8f46dc
	Issue introduced in 4.0 with commit 18d6b32fca3841f7cd9479b4024abd8a9b299281 and fixed in 6.18.40 with commit 69faa3779250df14f51d5084f938a99809546e52
	Issue introduced in 4.0 with commit 18d6b32fca3841f7cd9479b4024abd8a9b299281 and fixed in 7.1.4 with commit ba1867999dbc4085e6d8c52ac5266005b8b2bf07
	Issue introduced in 4.0 with commit 18d6b32fca3841f7cd9479b4024abd8a9b299281 and fixed in 7.2-rc3 with commit 3137b243c93982fe3460335e12f9247739766e10

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64594
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/gadget/function/f_fs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7fe895e0a9651518c4fc082487da770ff9c14c7f
	https://git.kernel.org/stable/c/0de6ebbabfbbc9c28350283dc97d8a519d5c6dd7
	https://git.kernel.org/stable/c/cb19e54ebe9baf3c3243083ade65c937339ccb7b
	https://git.kernel.org/stable/c/d5631081be07f20e764d3cb5c98ac0a1004fba51
	https://git.kernel.org/stable/c/c36393b0d14e1e9783888f821ffe29381b8f46dc
	https://git.kernel.org/stable/c/69faa3779250df14f51d5084f938a99809546e52
	https://git.kernel.org/stable/c/ba1867999dbc4085e6d8c52ac5266005b8b2bf07
	https://git.kernel.org/stable/c/3137b243c93982fe3460335e12f9247739766e10