Executive brief
The Linux kernel's USB host controller driver (xHCI) has a bug in how it handles data alignment for large USB transfers that span multiple memory ring segments. When a transfer is not properly aligned, data is temporarily staged through a bounce buffer, but only the last bounce buffer is tracked. This causes earlier buffers to leak DMA mappings and, for incoming data transfers, the original data is not copied back, leaving stale data in the destination buffer instead. This affects USB mass storage devices and can cause data integrity issues, particularly with dm-verity encrypted systems.
Technical details
This is a resource tracking and data corruption vulnerability in the xHCI (USB 3.0 host controller) driver within the Linux kernel. The root cause is that xhci_align_td() records bounce buffer state in td->bounce_seg, assuming TDs never span more than two ring segments. However, large fragmented transfers can cross three or more segments, each triggering a bounce buffer allocation at a link TRB. Only the last bounce buffer is tracked, causing earlier ones to leak DMA mappings and fail to copy data back to the URB buffer for IN transfers. The vulnerability requires a USB device to issue a sufficiently large, fragmented bulk transfer with data misaligned to the endpoint's wMaxPacketSize. The fix walks all segments from td->start_seg to td->bounce_seg, unmapping and handling each bounce buffer correctly. No privilege escalation or remote code execution is possible; the impact is local data corruption and DMA resource leaks.
Affected products
- Linux Linux kernel affected versions unknown
Timeline
- 2026-09-16: disclosed