Executive brief
A technical issue was identified in the Linux kernel's USB driver for DWC3 controllers, which are commonly used in mobile and embedded devices. The bug involves an incorrect way the software communicates with the hardware's internal registers during setup. While primarily a stability concern, if left unpatched, it could lead to unpredictable system behavior or hardware communication failures when using certain USB configurations.
Technical details
A vulnerability was identified in the Linux kernel's DWC3 USB driver within `drivers/usb/dwc3/core.c`. The function `dwc3_ulpi_setup()` incorrectly passed `dwc->regs` (a void __iomem pointer) to `dwc3_readl()` and `dwc3_writel()` instead of the expected `struct dwc3 *dwc` pointer. This resulted in a sparse warning regarding incorrect address spaces and could lead to undefined behavior or memory corruption during ULPI transceiver delay configuration. The issue was introduced by a previous change that modified the signature of the read/write helper functions. Patches have been released across several stable kernel branches including 6.18.x and 7.x.
Affected products
- Linux Linux Kernel 6.18.32 to 6.18.40, 7.0, 7.1.4, 7.2-rc3
Timeline
- 2026-07-03: other: Patch submitted by developer
- 2026-07-24: patched: Patch committed to stable tree
- 2026-07-25: disclosed: CVE published