CVE-2026-43250
USB DMA and SG Cleanup Flaw in Linux Kernel ChipIdea UDC
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chipidea | udc | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ChipIdea UDC USB driver. It occurs when a USB device is disconnected during an active multi-segment DMA transfer and then reconnected. The driver fails to properly clean up DMA and scatter-gather (SG) buffers in the _ep_nuke() function, leaving stale DMA state in the request.
Specifically, the num_mapped_sgs field and sgt.sgl pointer remain set with old values, causing the gadget driver to reuse requests with invalid DMA mappings. This leads to alignment errors and potential memory corruption because the hardware enqueue function skips DMA mapping due to the stale state.
The fix involves adding proper DMA unmapping and bounce buffer cleanup in the _ep_nuke() function to ensure requests are returned in a clean, reusable state after an endpoint shutdown.
How can this vulnerability impact me? :
This vulnerability can cause memory corruption and alignment errors in the USB device driver when a USB device is disconnected and reconnected during active data transfers.
Such memory corruption could potentially lead to system instability, crashes, or unexpected behavior in the USB subsystem, which might affect device functionality or overall system reliability.
What immediate steps should I take to mitigate this vulnerability?
This vulnerability is caused by improper cleanup of DMA and scatter-gather buffers in the ChipIdea UDC driver when a USB device is disconnected during an active transfer.
To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix for this issue. The fix involves adding proper DMA unmapping and bounce buffer cleanup in the _ep_nuke() function to ensure requests do not retain stale DMA mappings.
- Apply the patch that calls usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set.
- Apply the patch that calls sglist_do_debounce() with copy=false if a bounce buffer exists.
These steps ensure that when endpoints are shut down, requests are returned in a clean, reusable state, preventing alignment errors and potential memory corruption.