CVE-2026-43250 (GCVE-0-2026-43250)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-05-11 22:20
VLAI
Title
usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() The ChipIdea UDC driver can encounter "not page aligned sg buffer" errors when a USB device is reconnected after being disconnected during an active transfer. This occurs because _ep_nuke() returns requests to the gadget layer without properly unmapping DMA buffers or cleaning up scatter-gather bounce buffers. Root cause: When a disconnect happens during a multi-segment DMA transfer, the request's num_mapped_sgs field and sgt.sgl pointer remain set with stale values. The request is returned to the gadget driver with status -ESHUTDOWN but still has active DMA state. If the gadget driver reuses this request on reconnect without reinitializing it, the stale DMA state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero num_mapped_sgs) and attempt to use freed/invalid DMA addresses, leading to alignment errors and potential memory corruption. The normal completion path via _hardware_dequeue() properly calls usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before returning the request. The _ep_nuke() path must do the same cleanup to ensure requests are returned in a clean, reusable state. Fix: Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror the cleanup sequence in _hardware_dequeue(): - Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set - Call sglist_do_debounce() with copy=false if bounce buffer exists This ensures that when requests are returned due to endpoint shutdown, they don't retain stale DMA mappings. The 'false' parameter to sglist_do_debounce() prevents copying data back (appropriate for shutdown path where transfer was aborted).
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aa69a8093ff985873cb44fe1157bd6db29a20fe4 , < 1b72b834511d17f4d069d512f78671f3f210a2f1 (git)
Affected: aa69a8093ff985873cb44fe1157bd6db29a20fe4 , < f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec (git)
Affected: aa69a8093ff985873cb44fe1157bd6db29a20fe4 , < e74c436f8568af1c60942469d0a2300b3ada3857 (git)
Affected: aa69a8093ff985873cb44fe1157bd6db29a20fe4 , < cea2a1257a3b5ea3e769a445b34af13e6aa5a123 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.29
Unaffected: 0 , < 2.6.29 (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/chipidea/udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b72b834511d17f4d069d512f78671f3f210a2f1",
              "status": "affected",
              "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4",
              "versionType": "git"
            },
            {
              "lessThan": "f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec",
              "status": "affected",
              "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4",
              "versionType": "git"
            },
            {
              "lessThan": "e74c436f8568af1c60942469d0a2300b3ada3857",
              "status": "affected",
              "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4",
              "versionType": "git"
            },
            {
              "lessThan": "cea2a1257a3b5ea3e769a445b34af13e6aa5a123",
              "status": "affected",
              "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/chipidea/udc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\n\nThe ChipIdea UDC driver can encounter \"not page aligned sg buffer\"\nerrors when a USB device is reconnected after being disconnected\nduring an active transfer. This occurs because _ep_nuke() returns\nrequests to the gadget layer without properly unmapping DMA buffers\nor cleaning up scatter-gather bounce buffers.\n\nRoot cause:\nWhen a disconnect happens during a multi-segment DMA transfer, the\nrequest\u0027s num_mapped_sgs field and sgt.sgl pointer remain set with\nstale values. The request is returned to the gadget driver with status\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\nthis request on reconnect without reinitializing it, the stale DMA\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\nleading to alignment errors and potential memory corruption.\n\nThe normal completion path via _hardware_dequeue() properly calls\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\nreturning the request. The _ep_nuke() path must do the same cleanup\nto ensure requests are returned in a clean, reusable state.\n\nFix:\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\nthe cleanup sequence in _hardware_dequeue():\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\n\nThis ensures that when requests are returned due to endpoint shutdown,\nthey don\u0027t retain stale DMA mappings. The \u0027false\u0027 parameter to\nsglist_do_debounce() prevents copying data back (appropriate for\nshutdown path where transfer was aborted)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:20:54.786Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857"
        },
        {
          "url": "https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123"
        }
      ],
      "title": "usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43250",
    "datePublished": "2026-05-06T11:28:41.158Z",
    "dateReserved": "2026-05-01T14:12:55.996Z",
    "dateUpdated": "2026-05-11T22:20:54.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43250",
      "date": "2026-09-15",
      "epss": "0.00129",
      "percentile": "0.02837"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:46:08.000Z",
      "cve": "CVE-2026-43250",
      "id": "msrc_CVE-2026-43250",
      "initial_release_date": "2026-05-07T01:08:18.000Z",
      "product_status:known_affected": "8",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43250.json",
      "version": "11"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43250\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:45.620\",\"lastModified\":\"2026-06-17T10:49:14.347\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\\n\\nThe ChipIdea UDC driver can encounter \\\"not page aligned sg buffer\\\"\\nerrors when a USB device is reconnected after being disconnected\\nduring an active transfer. This occurs because _ep_nuke() returns\\nrequests to the gadget layer without properly unmapping DMA buffers\\nor cleaning up scatter-gather bounce buffers.\\n\\nRoot cause:\\nWhen a disconnect happens during a multi-segment DMA transfer, the\\nrequest\u0027s num_mapped_sgs field and sgt.sgl pointer remain set with\\nstale values. The request is returned to the gadget driver with status\\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\\nthis request on reconnect without reinitializing it, the stale DMA\\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\\nleading to alignment errors and potential memory corruption.\\n\\nThe normal completion path via _hardware_dequeue() properly calls\\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\\nreturning the request. The _ep_nuke() path must do the same cleanup\\nto ensure requests are returned in a clean, reusable state.\\n\\nFix:\\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\\nthe cleanup sequence in _hardware_dequeue():\\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\\n\\nThis ensures that when requests are returned due to endpoint shutdown,\\nthey don\u0027t retain stale DMA mappings. The \u0027false\u0027 parameter to\\nsglist_do_debounce() prevents copying data back (appropriate for\\nshutdown path where transfer was aborted).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/chipidea/udc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"aa69a8093ff985873cb44fe1157bd6db29a20fe4\",\"lessThan\":\"1b72b834511d17f4d069d512f78671f3f210a2f1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa69a8093ff985873cb44fe1157bd6db29a20fe4\",\"lessThan\":\"f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa69a8093ff985873cb44fe1157bd6db29a20fe4\",\"lessThan\":\"e74c436f8568af1c60942469d0a2300b3ada3857\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa69a8093ff985873cb44fe1157bd6db29a20fe4\",\"lessThan\":\"cea2a1257a3b5ea3e769a445b34af13e6aa5a123\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/chipidea/udc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.29\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.29\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.29\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"3C0B1026-23F7-4F83-B19F-153326AAEC72\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:36:24+00:00",
      "cve": "CVE-2026-43250",
      "id": "CVE-2026-43250",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43250.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:19:29Z",
      "cve": "CVE-2026-43250",
      "id": "CVE-2026-43250",
      "initial_release_date": "2026-05-07T02:16:45Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "370",
      "product_status:known_not_affected": "17",
      "product_status:recommended": "145",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43250",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43250.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.