CVE-2025-22022 (GCVE-0-2025-22022)

Vulnerability from cvelistv5 – Published: 2025-04-16 10:23 – Updated: 2026-08-05 11:56
VLAI
Title
usb: xhci: Apply the link chain quirk on NEC isoc endpoints
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two clearly different specimens of NEC uPD720200 (one with start/stop bug, one without) were seen to cause IOMMU faults after some Missed Service Errors. Faulting address is immediately after a transfer ring segment and patched dynamic debug messages revealed that the MSE was received when waiting for a TD near the end of that segment: [ 1.041954] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ffa08fe0 [ 1.042120] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09000 flags=0x0000] [ 1.042146] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09040 flags=0x0000] It gets even funnier if the next page is a ring segment accessible to the HC. Below, it reports MSE in segment at ff1e8000, plows through a zero-filled page at ff1e9000 and starts reporting events for TRBs in page at ff1ea000 every microframe, instead of jumping to seg ff1e6000. [ 7.041671] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0 [ 7.041999] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0 [ 7.042011] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint [ 7.042028] xhci_hcd: All TDs skipped for slot 1 ep 2. Clear skip flag. [ 7.042134] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint [ 7.042138] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31 [ 7.042144] xhci_hcd: Looking for event-dma 00000000ff1ea040 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820 [ 7.042259] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint [ 7.042262] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31 [ 7.042266] xhci_hcd: Looking for event-dma 00000000ff1ea050 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820 At some point completion events change from Isoch Buffer Overrun to Short Packet and the HC finally finds cycle bit mismatch in ff1ec000. [ 7.098130] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13 [ 7.098132] xhci_hcd: Looking for event-dma 00000000ff1ecc50 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820 [ 7.098254] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13 [ 7.098256] xhci_hcd: Looking for event-dma 00000000ff1ecc60 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820 [ 7.098379] xhci_hcd: Overrun event on slot 1 ep 2 It's possible that data from the isochronous device were written to random buffers of pending TDs on other endpoints (either IN or OUT), other devices or even other HCs in the same IOMMU domain. Lastly, an error from a different USB device on another HC. Was it caused by the above? I don't know, but it may have been. The disk was working without any other issues and generated PCIe traffic to starve the NEC of upstream BW and trigger those MSEs. The two HCs shared one x1 slot by means of a commercial "PCIe splitter" board. [ 7.162604] usb 10-2: reset SuperSpeed USB device number 3 using xhci_hcd [ 7.178990] sd 9:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s [ 7.179001] sd 9:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 04 02 ae 00 00 02 00 00 [ 7.179004] I/O error, dev sdb, sector 67284480 op 0x0:(READ) flags 0x80700 phys_seg 5 prio class 0 Fortunately, it appears that this ridiculous bug is avoided by setting the chain bit of Link TRBs on isochronous rings. Other ancient HCs are known which also expect the bit to be set and they ignore Link TRBs if it's not. Reportedly, 0.95 spec guaranteed that the bit is set. The bandwidth-starved NEC HC running a 32KB/uframe UVC endpoint reports tens of MSEs per second and runs into the bug within seconds. Chaining Link TRBs allows the same workload to run for many minutes, many times. No ne ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7e393a834b41001174a8fb3ae3bc23a749467760 , < abf2df229b6a9172cc1827749c1a446d28e00a2e (git)
Affected: 7e393a834b41001174a8fb3ae3bc23a749467760 , < 8b586de6f03c850ff48d42e539b4708d1f3f8f1a (git)
Affected: 7e393a834b41001174a8fb3ae3bc23a749467760 , < 1143f790a6316201dc8f067eba4c94ea97ecb6ca (git)
Affected: 7e393a834b41001174a8fb3ae3bc23a749467760 , < dbf427663ce272070d3004b5fca63a4a537d781c (git)
Affected: 7e393a834b41001174a8fb3ae3bc23a749467760 , < a4931d9fb99eb5462f3eaa231999d279c40afb21 (git)
Affected: 7e393a834b41001174a8fb3ae3bc23a749467760 , < 43a18225150ce874d23b37761c302a5dffee1595 (git)
Affected: 7e393a834b41001174a8fb3ae3bc23a749467760 , < 061a1683bae6ef56ab8fa392725ba7495515cd1d (git)
Affected: 7e393a834b41001174a8fb3ae3bc23a749467760 , < bb0ba4cb1065e87f9cc75db1fa454e56d0894d01 (git)
Affected: 5c7a6982e976b381595c9d4ee8e8c94564a40aec (git)
Affected: f12ea4a8ca7009fa2d54794c3fcb8e638453bcff (git)
Affected: 3.0.9 , < 3.1 (semver)
Affected: 3.1.1 , < 3.2 (semver)
Create a notification for this product.
Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.160 , ≤ 6.1.* (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.22 , ≤ 6.12.* (semver)
Unaffected: 6.13.10 , ≤ 6.13.* (semver)
Unaffected: 6.14.1 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "abf2df229b6a9172cc1827749c1a446d28e00a2e",
              "status": "affected",
              "version": "7e393a834b41001174a8fb3ae3bc23a749467760",
              "versionType": "git"
            },
            {
              "lessThan": "8b586de6f03c850ff48d42e539b4708d1f3f8f1a",
              "status": "affected",
              "version": "7e393a834b41001174a8fb3ae3bc23a749467760",
              "versionType": "git"
            },
            {
              "lessThan": "1143f790a6316201dc8f067eba4c94ea97ecb6ca",
              "status": "affected",
              "version": "7e393a834b41001174a8fb3ae3bc23a749467760",
              "versionType": "git"
            },
            {
              "lessThan": "dbf427663ce272070d3004b5fca63a4a537d781c",
              "status": "affected",
              "version": "7e393a834b41001174a8fb3ae3bc23a749467760",
              "versionType": "git"
            },
            {
              "lessThan": "a4931d9fb99eb5462f3eaa231999d279c40afb21",
              "status": "affected",
              "version": "7e393a834b41001174a8fb3ae3bc23a749467760",
              "versionType": "git"
            },
            {
              "lessThan": "43a18225150ce874d23b37761c302a5dffee1595",
              "status": "affected",
              "version": "7e393a834b41001174a8fb3ae3bc23a749467760",
              "versionType": "git"
            },
            {
              "lessThan": "061a1683bae6ef56ab8fa392725ba7495515cd1d",
              "status": "affected",
              "version": "7e393a834b41001174a8fb3ae3bc23a749467760",
              "versionType": "git"
            },
            {
              "lessThan": "bb0ba4cb1065e87f9cc75db1fa454e56d0894d01",
              "status": "affected",
              "version": "7e393a834b41001174a8fb3ae3bc23a749467760",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c7a6982e976b381595c9d4ee8e8c94564a40aec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f12ea4a8ca7009fa2d54794c3fcb8e638453bcff",
              "versionType": "git"
            },
            {
              "lessThan": "3.1",
              "status": "affected",
              "version": "3.0.9",
              "versionType": "semver"
            },
            {
              "lessThan": "3.2",
              "status": "affected",
              "version": "3.1.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.22",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.10",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.1",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.0.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.1.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Apply the link chain quirk on NEC isoc endpoints\n\nTwo clearly different specimens of NEC uPD720200 (one with start/stop\nbug, one without) were seen to cause IOMMU faults after some Missed\nService Errors. Faulting address is immediately after a transfer ring\nsegment and patched dynamic debug messages revealed that the MSE was\nreceived when waiting for a TD near the end of that segment:\n\n[ 1.041954] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ffa08fe0\n[ 1.042120] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09000 flags=0x0000]\n[ 1.042146] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09040 flags=0x0000]\n\nIt gets even funnier if the next page is a ring segment accessible to\nthe HC. Below, it reports MSE in segment at ff1e8000, plows through a\nzero-filled page at ff1e9000 and starts reporting events for TRBs in\npage at ff1ea000 every microframe, instead of jumping to seg ff1e6000.\n\n[ 7.041671] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\n[ 7.041999] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\n[ 7.042011] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042028] xhci_hcd: All TDs skipped for slot 1 ep 2. Clear skip flag.\n[ 7.042134] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042138] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\n[ 7.042144] xhci_hcd: Looking for event-dma 00000000ff1ea040 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.042259] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042262] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\n[ 7.042266] xhci_hcd: Looking for event-dma 00000000ff1ea050 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n\nAt some point completion events change from Isoch Buffer Overrun to\nShort Packet and the HC finally finds cycle bit mismatch in ff1ec000.\n\n[ 7.098130] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\n[ 7.098132] xhci_hcd: Looking for event-dma 00000000ff1ecc50 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.098254] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\n[ 7.098256] xhci_hcd: Looking for event-dma 00000000ff1ecc60 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.098379] xhci_hcd: Overrun event on slot 1 ep 2\n\nIt\u0027s possible that data from the isochronous device were written to\nrandom buffers of pending TDs on other endpoints (either IN or OUT),\nother devices or even other HCs in the same IOMMU domain.\n\nLastly, an error from a different USB device on another HC. Was it\ncaused by the above? I don\u0027t know, but it may have been. The disk\nwas working without any other issues and generated PCIe traffic to\nstarve the NEC of upstream BW and trigger those MSEs. The two HCs\nshared one x1 slot by means of a commercial \"PCIe splitter\" board.\n\n[ 7.162604] usb 10-2: reset SuperSpeed USB device number 3 using xhci_hcd\n[ 7.178990] sd 9:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s\n[ 7.179001] sd 9:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 04 02 ae 00 00 02 00 00\n[ 7.179004] I/O error, dev sdb, sector 67284480 op 0x0:(READ) flags 0x80700 phys_seg 5 prio class 0\n\nFortunately, it appears that this ridiculous bug is avoided by setting\nthe chain bit of Link TRBs on isochronous rings. Other ancient HCs are\nknown which also expect the bit to be set and they ignore Link TRBs if\nit\u0027s not. Reportedly, 0.95 spec guaranteed that the bit is set.\n\nThe bandwidth-starved NEC HC running a 32KB/uframe UVC endpoint reports\ntens of MSEs per second and runs into the bug within seconds. Chaining\nLink TRBs allows the same workload to run for many minutes, many times.\n\nNo ne\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - No network or adjacent path exists; the flaw is driven by a local unprivileged user starting a high-bandwidth isochronous stream on an already-attached UVC/USB-audio device on a NEC xHCI and concurrently starving the controller\u0027s upstream PCIe bandwidth. Physical plug-in is an alternative route but local access alone is sufficient.\nAC:L - The attacker controls both required conditions \u2014 the isochronous load (highest alt setting, ~32 KB/uframe) and the competing PCIe traffic that induces Missed Service Errors \u2014 and the commit reports tens of MSEs per second hitting the bug \"within seconds\", reproduced on two distinct uPD720200 specimens.\nPR:L - Only a normal local session is needed; the video/ALSA device nodes are granted to the logged-in user by the standard systemd-logind uaccess ACLs, and no root, CAP_SYS_ADMIN, or CAP_SYS_RAWIO is involved anywhere on the path.\nUI:N - The attacker initiates the isochronous stream and the competing I/O themselves; no victim action, mount, or file open by another user is required.\nS:U - The corrupted resources are kernel DMA buffers managed by the same kernel security authority, and the IOMMU is not bypassed \u2014 it actually faults on out-of-domain accesses, confining the damage to the kernel itself.\nC:H - The controller fetches garbage adjacent memory as TRBs and honors their buffer pointers, so on isochronous OUT endpoints it DMA-reads arbitrary in-domain kernel memory and transmits it to the attacker\u0027s USB device, and on IOMMU-less systems the read reaches all of RAM.\nI:H - Attacker-supplied isochronous device data is DMA-written into unrelated kernel buffers belonging to other endpoints, other devices, and even other host controllers, giving an attacker-influenced kernel write primitive; real corruption was observed as block I/O errors on an unrelated disk.\nA:H - Observed effects include IOMMU page-fault storms, wedged endpoints replaying bogus events every microframe, USB device resets, and storage I/O failures, and overwriting adjacent transfer-ring segments or arbitrary kernel structures readily produces an oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:04.678Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/abf2df229b6a9172cc1827749c1a446d28e00a2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b586de6f03c850ff48d42e539b4708d1f3f8f1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1143f790a6316201dc8f067eba4c94ea97ecb6ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbf427663ce272070d3004b5fca63a4a537d781c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4931d9fb99eb5462f3eaa231999d279c40afb21"
        },
        {
          "url": "https://git.kernel.org/stable/c/43a18225150ce874d23b37761c302a5dffee1595"
        },
        {
          "url": "https://git.kernel.org/stable/c/061a1683bae6ef56ab8fa392725ba7495515cd1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb0ba4cb1065e87f9cc75db1fa454e56d0894d01"
        }
      ],
      "title": "usb: xhci: Apply the link chain quirk on NEC isoc endpoints",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22022",
    "datePublished": "2025-04-16T10:23:27.423Z",
    "dateReserved": "2024-12-29T08:45:45.807Z",
    "dateUpdated": "2026-08-05T11:56:04.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22022",
      "date": "2026-08-09",
      "epss": "0.00188",
      "percentile": "0.08538"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:53:49.000Z",
      "cve": "CVE-2025-22022",
      "id": "msrc_CVE-2025-22022",
      "initial_release_date": "2025-04-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "9",
      "product_status:under_investigation": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: xhci: Apply the link chain quirk on NEC isoc endpoints",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-22022.json",
      "version": "7"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22022\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-16T11:15:42.883\",\"lastModified\":\"2026-07-30T06:22:03.963\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: xhci: Apply the link chain quirk on NEC isoc endpoints\\n\\nTwo clearly different specimens of NEC uPD720200 (one with start/stop\\nbug, one without) were seen to cause IOMMU faults after some Missed\\nService Errors. Faulting address is immediately after a transfer ring\\nsegment and patched dynamic debug messages revealed that the MSE was\\nreceived when waiting for a TD near the end of that segment:\\n\\n[ 1.041954] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ffa08fe0\\n[ 1.042120] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09000 flags=0x0000]\\n[ 1.042146] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09040 flags=0x0000]\\n\\nIt gets even funnier if the next page is a ring segment accessible to\\nthe HC. Below, it reports MSE in segment at ff1e8000, plows through a\\nzero-filled page at ff1e9000 and starts reporting events for TRBs in\\npage at ff1ea000 every microframe, instead of jumping to seg ff1e6000.\\n\\n[ 7.041671] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\\n[ 7.041999] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\\n[ 7.042011] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\\n[ 7.042028] xhci_hcd: All TDs skipped for slot 1 ep 2. Clear skip flag.\\n[ 7.042134] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\\n[ 7.042138] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\\n[ 7.042144] xhci_hcd: Looking for event-dma 00000000ff1ea040 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\\n[ 7.042259] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\\n[ 7.042262] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\\n[ 7.042266] xhci_hcd: Looking for event-dma 00000000ff1ea050 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\\n\\nAt some point completion events change from Isoch Buffer Overrun to\\nShort Packet and the HC finally finds cycle bit mismatch in ff1ec000.\\n\\n[ 7.098130] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\\n[ 7.098132] xhci_hcd: Looking for event-dma 00000000ff1ecc50 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\\n[ 7.098254] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\\n[ 7.098256] xhci_hcd: Looking for event-dma 00000000ff1ecc60 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\\n[ 7.098379] xhci_hcd: Overrun event on slot 1 ep 2\\n\\nIt\u0027s possible that data from the isochronous device were written to\\nrandom buffers of pending TDs on other endpoints (either IN or OUT),\\nother devices or even other HCs in the same IOMMU domain.\\n\\nLastly, an error from a different USB device on another HC. Was it\\ncaused by the above? I don\u0027t know, but it may have been. The disk\\nwas working without any other issues and generated PCIe traffic to\\nstarve the NEC of upstream BW and trigger those MSEs. The two HCs\\nshared one x1 slot by means of a commercial \\\"PCIe splitter\\\" board.\\n\\n[ 7.162604] usb 10-2: reset SuperSpeed USB device number 3 using xhci_hcd\\n[ 7.178990] sd 9:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s\\n[ 7.179001] sd 9:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 04 02 ae 00 00 02 00 00\\n[ 7.179004] I/O error, dev sdb, sector 67284480 op 0x0:(READ) flags 0x80700 phys_seg 5 prio class 0\\n\\nFortunately, it appears that this ridiculous bug is avoided by setting\\nthe chain bit of Link TRBs on isochronous rings. Other ancient HCs are\\nknown which also expect the bit to be set and they ignore Link TRBs if\\nit\u0027s not. Reportedly, 0.95 spec guaranteed that the bit is set.\\n\\nThe bandwidth-starved NEC HC running a 32KB/uframe UVC endpoint reports\\ntens of MSEs per second and runs into the bug within seconds. Chaining\\nLink TRBs allows the same workload to run for many minutes, many times.\\n\\nNo ne\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: xhci: Aplicar la peculiaridad de la cadena de enlace en los endpoints isoc de NEC Se observ\u00f3 que dos ejemplares claramente diferentes de NEC uPD720200 (uno con un error de inicio/detenci\u00f3n y otro sin \u00e9l) causaban fallas de IOMMU despu\u00e9s de algunos errores de servicio perdido. La direcci\u00f3n con fallas se encuentra inmediatamente despu\u00e9s de un segmento de anillo de transferencia y los mensajes de depuraci\u00f3n din\u00e1mica parcheados revelaron que se recibi\u00f3 el MSE cuando se esperaba un TD cerca del final de ese segmento: [1.041954] xhci_hcd: Error de intervalo de servicio faltante para la ranura 1 ep 2 se esperaba TD DMA ffa08fe0 [1.042120] xhci_hcd: AMD-Vi: Evento registrado [IO_PAGE_FAULT dominio=0x0005 direcci\u00f3n=0xffa09000 indicadores=0x0000] [1.042146] xhci_hcd: AMD-Vi: Evento registrado [IO_PAGE_FAULT dominio=0x0005 direcci\u00f3n=0xffa09040 indicadores=0x0000] Se vuelve a\u00fan m\u00e1s divertido si la siguiente p\u00e1gina es un segmento de anillo accesible para el HC. A continuaci\u00f3n, informa MSE en el segmento en ff1e8000, recorre una p\u00e1gina llena de ceros en ff1e9000 y comienza a informar eventos para TRB en la p\u00e1gina en ff1ea000 cada microtrama, en lugar de saltar al segmento ff1e6000. [7.041671] xhci_hcd: Error de intervalo de servicio perdido para la ranura 1 ep 2 esperada TD DMA ff1e8fe0 [7.041999] xhci_hcd: Error de intervalo de servicio perdido para la ranura 1 ep 2 esperada TD DMA ff1e8fe0 [7.042011] xhci_hcd: ADVERTENCIA: evento de desbordamiento de b\u00fafer para la ranura 1 ep 2 en el endpoint [7.042028] xhci_hcd: Se omitieron todos los TD para la ranura 1 ep 2. Borrar el indicador de omisi\u00f3n. [ 7.042134] xhci_hcd: ADVERTENCIA: evento de desbordamiento de b\u00fafer para la ranura 1 ep 2 en el endpoint [ 7.042138] xhci_hcd: ERROR Evento de transferencia TRB DMA ptr no forma parte del TD actual ep_index 2 comp_code 31 [ 7.042144] xhci_hcd: Buscando evento-dma 00000000ff1ea040 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820 [ 7.042259] xhci_hcd: ADVERTENCIA: evento de desbordamiento de b\u00fafer para la ranura 1 ep 2 en el endpoint [ 7.042262] xhci_hcd: ERROR Evento de transferencia TRB DMA ptr no forma parte del TD actual ep_index 2 comp_code 31 [ 7.042266] xhci_hcd: Buscando evento-dma 00000000ff1ea050 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820 En alg\u00fan punto, los eventos de finalizaci\u00f3n cambian de Desbordamiento de b\u00fafer de isocrono a Paquete corto y el HC finalmente encuentra una falta de coincidencia de bits de ciclo en ff1ec000. [ 7.098130] xhci_hcd: ERROR El punto de transferencia TRB DMA del evento no forma parte del TD actual ep_index 2 comp_code 13 [ 7.098132] xhci_hcd: Buscando el punto de transferencia event-dma 00000000ff1ecc50 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820 [ 7.098254] xhci_hcd: ERROR El punto de transferencia TRB DMA del evento no forma parte del TD actual ep_index 2 comp_code 13 [ 7.098256] xhci_hcd: Buscando el punto de transferencia event-dma 00000000ff1ecc60 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820 [7.098379] xhci_hcd: Evento de saturaci\u00f3n en la ranura 1, episodio 2. Es posible que los datos del dispositivo is\u00f3crono se escribieran en b\u00faferes aleatorios de TD pendientes en otros endpoints (de entrada o de salida), otros dispositivos o incluso otros HC en el mismo dominio IOMMU. Por \u00faltimo, se produjo un error de un dispositivo USB diferente en otro HC. \u00bfFue causado por lo anterior? No lo s\u00e9, pero podr\u00eda haber sido. El disco funcionaba sin problemas y gener\u00f3 tr\u00e1fico PCIe que priv\u00f3 al NEC de BW ascendente y activ\u00f3 esos MSE. Los dos HC compart\u00edan una ranura x1 mediante una placa divisora PCIe comercial. [ 7.162604] usb 10-2: restablecer el dispositivo USB SuperSpeed n\u00famero 3 usando xhci_hcd [ 7.178990] sd 9:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Resultado: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s [ 7.179001] sd 9:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 04 02 ae 00 00 02 00 00 [ 7.179004] Error de E/S, dev sdb, sector 67284480 op 0x0:(READ) ---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/host/xhci.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7e393a834b41001174a8fb3ae3bc23a749467760\",\"lessThan\":\"abf2df229b6a9172cc1827749c1a446d28e00a2e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7e393a834b41001174a8fb3ae3bc23a749467760\",\"lessThan\":\"8b586de6f03c850ff48d42e539b4708d1f3f8f1a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7e393a834b41001174a8fb3ae3bc23a749467760\",\"lessThan\":\"1143f790a6316201dc8f067eba4c94ea97ecb6ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7e393a834b41001174a8fb3ae3bc23a749467760\",\"lessThan\":\"dbf427663ce272070d3004b5fca63a4a537d781c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7e393a834b41001174a8fb3ae3bc23a749467760\",\"lessThan\":\"a4931d9fb99eb5462f3eaa231999d279c40afb21\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7e393a834b41001174a8fb3ae3bc23a749467760\",\"lessThan\":\"43a18225150ce874d23b37761c302a5dffee1595\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7e393a834b41001174a8fb3ae3bc23a749467760\",\"lessThan\":\"061a1683bae6ef56ab8fa392725ba7495515cd1d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7e393a834b41001174a8fb3ae3bc23a749467760\",\"lessThan\":\"bb0ba4cb1065e87f9cc75db1fa454e56d0894d01\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5c7a6982e976b381595c9d4ee8e8c94564a40aec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f12ea4a8ca7009fa2d54794c3fcb8e638453bcff\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.0.9\",\"lessThan\":\"3.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.1.1\",\"lessThan\":\"3.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/host/xhci.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.248\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.160\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.120\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.22\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.10\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.1\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.12.22\",\"matchCriteriaId\":\"3305898E-492D-4B2D-A104-239EBBFCF257\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.10\",\"matchCriteriaId\":\"E9410CA0-CED8-49BE-9DB4-856654736C32\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"82E37853-46C8-4BB6-9FA4-9838FD34D6A2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/061a1683bae6ef56ab8fa392725ba7495515cd1d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1143f790a6316201dc8f067eba4c94ea97ecb6ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/43a18225150ce874d23b37761c302a5dffee1595\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8b586de6f03c850ff48d42e539b4708d1f3f8f1a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a4931d9fb99eb5462f3eaa231999d279c40afb21\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/abf2df229b6a9172cc1827749c1a446d28e00a2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb0ba4cb1065e87f9cc75db1fa454e56d0894d01\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dbf427663ce272070d3004b5fca63a4a537d781c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:30:38+00:00",
      "cve": "CVE-2025-22022",
      "id": "CVE-2025-22022",
      "initial_release_date": "2025-04-16T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: xhci: Apply the link chain quirk on NEC isoc endpoints",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22022.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:00:57Z",
      "cve": "CVE-2025-22022",
      "id": "CVE-2025-22022",
      "initial_release_date": "2025-04-17T01:33:27Z",
      "product_status:known_affected": "649",
      "product_status:recommended": "444",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-22022",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-22022.json",
      "version": "51"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.