Executive brief
A bug in the Linux kernel's USB 3.0 controller driver (DWC3) can cause a system fault when stopping a USB transfer on certain Intel/Qualcomm controller versions. When an active transfer is improperly aborted, the controller may continue writing to memory that has already been freed, resulting in a kernel crash and potential denial of service.
Technical details
The vulnerability exists in the DWC3 USB endpoint driver's handling of the forceRM register bit in the DEPCMD control register. When forceRM=1 is set during an EndTransfer command on DWC_usb31 v2.00a and v2.10a controllers, an aborted transfer can remain active after the command completes. A subsequent StartTransfer on the same endpoint then triggers memory writes to a buffer that was already unmapped and freed during cleanup, causing an SMMU (System Memory Management Unit) fault. The fix clears the forceRM bit (forceRM=0) when issuing EndTransfer, which aligns with newer DWC3 programming guide recommendations and eliminates the issue. The vulnerability affects kernel versions since the introduction of DWC31 v2.00a support and has been patched in stable kernel releases.
Affected products
- Linux Linux kernel 4.9.y to 7.2.y (DWC3 driver)
Timeline
- 2026-09-16: disclosed
- 2026-09-11: patched: Fix committed to stable kernel branches