CVE-2026-43250 (GCVE-0-2026-43250)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-05-11 22:20
VLAI?
Title
usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() The ChipIdea UDC driver can encounter "not page aligned sg buffer" errors when a USB device is reconnected after being disconnected during an active transfer. This occurs because _ep_nuke() returns requests to the gadget layer without properly unmapping DMA buffers or cleaning up scatter-gather bounce buffers. Root cause: When a disconnect happens during a multi-segment DMA transfer, the request's num_mapped_sgs field and sgt.sgl pointer remain set with stale values. The request is returned to the gadget driver with status -ESHUTDOWN but still has active DMA state. If the gadget driver reuses this request on reconnect without reinitializing it, the stale DMA state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero num_mapped_sgs) and attempt to use freed/invalid DMA addresses, leading to alignment errors and potential memory corruption. The normal completion path via _hardware_dequeue() properly calls usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before returning the request. The _ep_nuke() path must do the same cleanup to ensure requests are returned in a clean, reusable state. Fix: Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror the cleanup sequence in _hardware_dequeue(): - Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set - Call sglist_do_debounce() with copy=false if bounce buffer exists This ensures that when requests are returned due to endpoint shutdown, they don't retain stale DMA mappings. The 'false' parameter to sglist_do_debounce() prevents copying data back (appropriate for shutdown path where transfer was aborted).
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: aa69a8093ff985873cb44fe1157bd6db29a20fe4 , < 1b72b834511d17f4d069d512f78671f3f210a2f1 (git)
Affected: aa69a8093ff985873cb44fe1157bd6db29a20fe4 , < f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec (git)
Affected: aa69a8093ff985873cb44fe1157bd6db29a20fe4 , < e74c436f8568af1c60942469d0a2300b3ada3857 (git)
Affected: aa69a8093ff985873cb44fe1157bd6db29a20fe4 , < cea2a1257a3b5ea3e769a445b34af13e6aa5a123 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.29
Unaffected: 0 , < 2.6.29 (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/chipidea/udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b72b834511d17f4d069d512f78671f3f210a2f1",
              "status": "affected",
              "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4",
              "versionType": "git"
            },
            {
              "lessThan": "f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec",
              "status": "affected",
              "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4",
              "versionType": "git"
            },
            {
              "lessThan": "e74c436f8568af1c60942469d0a2300b3ada3857",
              "status": "affected",
              "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4",
              "versionType": "git"
            },
            {
              "lessThan": "cea2a1257a3b5ea3e769a445b34af13e6aa5a123",
              "status": "affected",
              "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/chipidea/udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\n\nThe ChipIdea UDC driver can encounter \"not page aligned sg buffer\"\nerrors when a USB device is reconnected after being disconnected\nduring an active transfer. This occurs because _ep_nuke() returns\nrequests to the gadget layer without properly unmapping DMA buffers\nor cleaning up scatter-gather bounce buffers.\n\nRoot cause:\nWhen a disconnect happens during a multi-segment DMA transfer, the\nrequest\u0027s num_mapped_sgs field and sgt.sgl pointer remain set with\nstale values. The request is returned to the gadget driver with status\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\nthis request on reconnect without reinitializing it, the stale DMA\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\nleading to alignment errors and potential memory corruption.\n\nThe normal completion path via _hardware_dequeue() properly calls\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\nreturning the request. The _ep_nuke() path must do the same cleanup\nto ensure requests are returned in a clean, reusable state.\n\nFix:\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\nthe cleanup sequence in _hardware_dequeue():\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\n\nThis ensures that when requests are returned due to endpoint shutdown,\nthey don\u0027t retain stale DMA mappings. The \u0027false\u0027 parameter to\nsglist_do_debounce() prevents copying data back (appropriate for\nshutdown path where transfer was aborted)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:20:54.786Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857"
        },
        {
          "url": "https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123"
        }
      ],
      "title": "usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43250",
    "datePublished": "2026-05-06T11:28:41.158Z",
    "dateReserved": "2026-05-01T14:12:55.996Z",
    "dateUpdated": "2026-05-11T22:20:54.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43250",
      "date": "2026-05-23",
      "epss": "0.00016",
      "percentile": "0.03788"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43250\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:45.620\",\"lastModified\":\"2026-05-12T18:51:16.140\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\\n\\nThe ChipIdea UDC driver can encounter \\\"not page aligned sg buffer\\\"\\nerrors when a USB device is reconnected after being disconnected\\nduring an active transfer. This occurs because _ep_nuke() returns\\nrequests to the gadget layer without properly unmapping DMA buffers\\nor cleaning up scatter-gather bounce buffers.\\n\\nRoot cause:\\nWhen a disconnect happens during a multi-segment DMA transfer, the\\nrequest\u0027s num_mapped_sgs field and sgt.sgl pointer remain set with\\nstale values. The request is returned to the gadget driver with status\\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\\nthis request on reconnect without reinitializing it, the stale DMA\\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\\nleading to alignment errors and potential memory corruption.\\n\\nThe normal completion path via _hardware_dequeue() properly calls\\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\\nreturning the request. The _ep_nuke() path must do the same cleanup\\nto ensure requests are returned in a clean, reusable state.\\n\\nFix:\\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\\nthe cleanup sequence in _hardware_dequeue():\\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\\n\\nThis ensures that when requests are returned due to endpoint shutdown,\\nthey don\u0027t retain stale DMA mappings. The \u0027false\u0027 parameter to\\nsglist_do_debounce() prevents copying data back (appropriate for\\nshutdown path where transfer was aborted).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.29\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"3C0B1026-23F7-4F83-B19F-153326AAEC72\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.