CVE-2016-7912: Use-after-free vulnerability in the ffs_user_copy_worker function in drivers/usb/gadget/function/f_fs.c in...

Security readout for executives and security teams

CVE-2016-7912 is a Linux kernel use-after-free issue in the USB gadget FunctionFS code. A local user could potentially use it to gain higher privileges on affected systems. The provided sources identify Linux kernels before 4.5.3 as affected, with Android also referencing the issue in its November 2016 bulletin. Exposure is most likely on Linux or Android-derived systems running affected kernel code before the relevant fix or vendor backport. Risk depends on whether the USB gadget FunctionFS path is built and reachable, and whether untrusted local users or apps can interact with the vulnerable interface. Treat this as a high-priority legacy kernel exposure where untrusted local code is possible. It is less urgent than a remotely exploitable flaw, but kernel privilege escalation can turn limited access into full system control. Mitigation focus: Apply a vendor kernel update containing the upstream fix or equivalent backport.; For mainline kernels, update to Linux 4.5.3 or later where applicable.; Check Android or device vendor bulletins for platform-specific patched builds..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.