Executive brief
The Aspeed USB Device Controller driver in the Linux kernel failed to validate DMA memory allocation during device initialization. If memory allocation failed, the driver would attempt to use a null pointer when setting up endpoints, causing a kernel crash that could disrupt USB functionality and potentially prevent the system from booting on affected hardware.
Technical details
This is a null pointer dereference vulnerability in the Aspeed UDC (USB Device Controller) driver's probe function. The vulnerability occurs because ast_udc_probe() allocates a coherent DMA buffer (udc->ep0_buf) but fails to check whether the allocation succeeded before passing it to ast_udc_init_ep() during endpoint initialization. If dma_alloc_coherent() returns null due to memory pressure, the subsequent pointer dereference causes a kernel panic. The fix adds an explicit null check immediately after allocation and includes a local cleanup helper to safely unwind resources without calling the full ast_udc_remove() path, which would attempt to unregister a gadget that was never registered. The vulnerability is local to device probe and requires no network access; exploitation occurs automatically on systems with insufficient DMA memory during Aspeed UDC driver initialization.
Affected products
- Linux Linux kernel 6.16 and later (fix available)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-09-14: patched: Fix committed to stable kernel trees by Greg Kroah-Hartman