Executive brief
A vulnerability in the Linux kernel's USB ChipIdea driver could allow a local user to cause system instability or memory corruption. The issue occurs when a USB device is disconnected during an active data transfer, leaving behind 'stale' memory mappings that are incorrectly reused upon reconnection. This can lead to unauthorized memory access or system crashes, potentially impacting the reliability and security of devices using this specific USB controller.
Technical details
A vulnerability in the ChipIdea UDC driver's _ep_nuke() function leads to an out-of-bounds write (CWE-787). When a USB disconnect occurs during an active multi-segment DMA transfer, the driver fails to unmap DMA buffers or clean up scatter-gather bounce buffers. This leaves stale values in the num_mapped_sgs and sgt.sgl fields. If the gadget driver reuses the request upon reconnection, the hardware_enqueue() function skips necessary DMA mapping and attempts to use invalid or freed DMA addresses. This results in alignment errors and potential memory corruption. Patches have been released for multiple stable kernel branches to ensure proper cleanup via usb_gadget_unmap_request_by_dev() and sglist_do_debounce().
Affected products
- Linux Linux Kernel 2.6.29 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-08: disclosed: Initial patch submitted by developer
- 2026-05-06: advisory: CVE published by kernel.org
- 2026-05-12: other: NIST analysis and enrichment completed