{"id":"CVE-2026-43250","title":"usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\n\nThe ChipIdea UDC driver can encounter \"not page aligned sg buffer\"\nerrors when a USB device is reconnected aft…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= aa69a8093ff985873cb44fe1157bd6db29a20fe4 < aad97c92119cb85db105ddda4a44c86cc0748e8c","Linux >= aa69a8093ff985873cb44fe1157bd6db29a20fe4 < 1b72b834511d17f4d069d512f78671f3f210a2f1","Linux >= aa69a8093ff985873cb44fe1157bd6db29a20fe4 < f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec","Linux >= aa69a8093ff985873cb44fe1157bd6db29a20fe4 < e74c436f8568af1c60942469d0a2300b3ada3857","Linux >= aa69a8093ff985873cb44fe1157bd6db29a20fe4 < cea2a1257a3b5ea3e769a445b34af13e6aa5a123","Linux 2.6.29"],"published":"2026-05-06","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:40:25.395Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43250","references":[{"url":"https://git.kernel.org/stable/c/aad97c92119cb85db105ddda4a44c86cc0748e8c"},{"url":"https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1"},{"url":"https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec"},{"url":"https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857"},{"url":"https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123"}],"tags":["cve.org"],"epss":0.00175,"epssPercentile":0.06623,"ingestedAt":"2026-10-21T12:48:53.643Z","slug":"CVE-2026-43250","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\n\nThe ChipIdea UDC driver can encounter \"not page aligned sg buffer\"\nerrors when a USB device is reconnected after being disconnected\nduring an active transfer. This occurs because _ep_nuke() returns\nrequests to the gadget layer without properly unmapping DMA buffers\nor cleaning up scatter-gather bounce buffers.\n\nRoot cause:\nWhen a disconnect happens during a multi-segment DMA transfer, the\nrequest's num_mapped_sgs field and sgt.sgl pointer remain set with\nstale values. The request is returned to the gadget driver with status\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\nthis request on reconnect without reinitializing it, the stale DMA\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\nleading to alignment errors and potential memory corruption.\n\nThe normal completion path via _hardware_dequeue() properly calls\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\nreturning the request. The _ep_nuke() path must do the same cleanup\nto ensure requests are returned in a clean, reusable state.\n\nFix:\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\nthe cleanup sequence in _hardware_dequeue():\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\n\nThis ensures that when requests are returned due to endpoint shutdown,\nthey don't retain stale DMA mappings. The 'false' parameter to\nsglist_do_debounce() prevents copying data back (appropriate for\nshutdown path where transfer was aborted).\n\n## Affected\n\n- `Linux >= aa69a8093ff985873cb44fe1157bd6db29a20fe4 < aad97c92119cb85db105ddda4a44c86cc0748e8c`\n- `Linux >= aa69a8093ff985873cb44fe1157bd6db29a20fe4 < 1b72b834511d17f4d069d512f78671f3f210a2f1`\n- `Linux >= aa69a8093ff985873cb44fe1157bd6db29a20fe4 < f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec`\n- `Linux >= aa69a8093ff985873cb44fe1157bd6db29a20fe4 < e74c436f8568af1c60942469d0a2300b3ada3857`\n- `Linux >= aa69a8093ff985873cb44fe1157bd6db29a20fe4 < cea2a1257a3b5ea3e769a445b34af13e6aa5a123`\n- `Linux 2.6.29`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}