CVE-2026-90030
Description
A flaw was found in the Linux kernel's DWC3 USB controller driver. When the forceRM bit is incorrectly set during an EndTransfer command, a transfer may remain active even after completion. A subsequent StartTransfer on the same endpoint can then trigger writes to an unmapped memory buffer, leading to a System Memory Management Unit (SMMU) fault. This issue can result in system instability or a denial of service.
Statement
An EndTransfer state handling flaw in the DWC3 USB gadget driver can leave an aborted transfer active when forceRM is set on DWC_usb31 v2.00a and v2.10a controllers. After ep_dequeue cleanup has unmapped the transfer buffer, a later StartTransfer on the same endpoint may still cause controller writes associated with the aborted transfer. The observed result is an SMMU fault and kernel denial of service, and on systems without effective DMA isolation the same pattern is a plausible DMA use after unmap memory-corruption candidate. For the CVSS the PR:N is used because a USB host does not need credentials on the gadget device, but physical USB attachment is required and this is not IP network reachable.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.4 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
