HIGH
dwc3 EndTransfer UAF
CVE-2026-90030
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when issuing EndTransfer The forceRM bit of the DEPCMD register controls the behavior of the EndTransfer command used to stop an active transfer. Older DWC3 programming guide revisions recommended setting forceRM=1 when issuing EndTransfer. Newer programming guide revisions recommend issuing EndTransfer with forceRM cleared. With forceRM=1 on DWC_usb31 v2.00a and v2.10a controllers, a transfer aborted through the ep_dequeue path was observed to remain active after EndTransfer completion. A subsequent StartTransfer issued on the same endpoint triggered writes associated with the aborted transfer. This resulted in an SMMU fault because the transfer buffer had already been unmapped during EndTransfer command-completion cleanup. Using forceRM=0 eliminates the issue. Although older DWC3 programming guide revisions recommended setting forceRM=1, no issues are known from using forceRM=0. Clear forceRM when issuing EndTransfer to provide consistent EndTransfer behavior and align with newer programming guide recommendations.
02KernelScan AI Analysis
Risk summary
A use-after-free in the DWC3 USB gadget driver allows a transfer aborted via endpoint dequeue to remain active after EndTransfer completion. A subsequent StartTransfer on the same endpoint triggers writes to an already-unmapped buffer, causing memory corruption or an SMMU fault. This is reachable from a connected USB host through the gadget endpoint interface on affected DWC31 v2.00a/v2.10a controllers.
Vulnerability analysis
When the USB gadget driver stops an active transfer, it previously told the controller to force resource removal. On affected DWC31 controller versions, this caused the transfer to stay active even after the stop command completed. If a new transfer then started on the same endpoint, the controller wrote to the old buffer, which had already been unmapped from memory. This use-after-free leads to memory corruption and can trigger an SMMU fault. The fix stops transfers without forcing resource removal, letting the controller finish properly before the buffer is released. A connected USB host can trigger this by causing the gadget to abort and restart endpoint transfers; no privileges on the target device are needed.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 6.6.37 | 6.7 | 9f1e57c484f9 |
| 6.12 | — | 6.12.112 | 0afe5c31612d |
| 6.18 | — | 6.18.51 | e01408ee52fe |
| 7.2 | — | 7.2.5 | b58e6200450d |
| mainline | — | 7.3-rc2 | — |