CVE-2026-43250

Status: UPDATED  |  Advisory ID: CVE-2026-43250

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()

The ChipIdea UDC driver can encounter "not page aligned sg buffer"

errors when a USB device is reconnected after being disconnected

during an active transfer. This occurs because _ep_nuke() returns

requests to the gadget layer without properly unmapping DMA buffers

or cleaning up scatter-gather bounce buffers.

Root cause:

When a disconnect happens during a multi-segment DMA transfer, the

request's num_mapped_sgs field and sgt.sgl pointer remain set with

stale values. The request is returned to the gadget driver with status

-ESHUTDOWN but still has active DMA state. If the gadget driver reuses

this request on reconnect without reinitializing it, the stale DMA

state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero

num_mapped_sgs) and attempt to use freed/invalid DMA addresses,

leading to alignment errors and potential memory corruption.

The normal completion path via _hardware_dequeue() properly calls

usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before

returning the request. The _ep_nuke() path must do the same cleanup

to ensure requests are returned in a clean, reusable state.

Fix:

Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror

the cleanup sequence in _hardware_dequeue():

- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set

- Call sglist_do_debounce() with copy=false if bounce buffer exists

This ensures that when requests are returned due to endpoint shutdown,

they don't retain stale DMA mappings. The 'false' parameter to

sglist_do_debounce() prevents copying data back (appropriate for

shutdown path where transfer was aborted). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References