{"id":"CVE-2026-90030","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: clear forceRM when issuing EndTransfer\n\nThe forceRM bit of the DEPCMD register controls the behavior of the\nEndTransfer command used to stop an active transf…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: clear forceRM when issuing EndTransfer\n\nThe forceRM bit of the DEPCMD register controls the behavior of the\nEndTransfer command used to stop an active transf…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 1e43c86d84fb0503e82a143e017f35421498fc1a < 0afe5c31612de3d18cc6d16e616da4a48ba1e5a2","Linux >= 1e43c86d84fb0503e82a143e017f35421498fc1a < e01408ee52fe5cb2d0b43f47f359336af2b6c316","Linux >= 1e43c86d84fb0503e82a143e017f35421498fc1a < b58e6200450d350314db0ecda7d6d1bde3281e80","Linux ab99c4be945724b032cc55e05c6738fe1d84bf70","Linux >= 6.6.37 < 6.7","Linux 6.9"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T15:18:26.160","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90030","references":[{"url":"https://git.kernel.org/stable/c/0afe5c31612de3d18cc6d16e616da4a48ba1e5a2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b58e6200450d350314db0ecda7d6d1bde3281e80","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e01408ee52fe5cb2d0b43f47f359336af2b6c316","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.932Z","epss":0.00151,"epssPercentile":0.04602,"slug":"CVE-2026-90030","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: clear forceRM when issuing EndTransfer\n\nThe forceRM bit of the DEPCMD register controls the behavior of the\nEndTransfer command used to stop an active transfer. Older DWC3\nprogramming guide revisions recommended setting forceRM=1 when\nissuing EndTransfer. Newer programming guide revisions recommend\nissuing EndTransfer with forceRM cleared.\n\nWith forceRM=1 on DWC_usb31 v2.00a and v2.10a controllers, a transfer\naborted through the ep_dequeue path was observed to remain active\nafter EndTransfer completion. A subsequent StartTransfer issued on the\nsame endpoint triggered writes associated with the aborted transfer.\nThis resulted in an SMMU fault because the transfer buffer had already\nbeen unmapped during EndTransfer command-completion cleanup.\n\nUsing forceRM=0 eliminates the issue. Although older DWC3 programming\nguide revisions recommended setting forceRM=1, no issues are known\nfrom using forceRM=0. Clear forceRM when issuing EndTransfer to provide\nconsistent EndTransfer behavior and align with newer programming guide\nrecommendations.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":204999,"id":"CVE-2026-90030","ts":1789570702481,"field":"cvss","old":null,"new":"7.8"},{"seq":204998,"id":"CVE-2026-90030","ts":1789570702481,"field":"severity","old":"none","new":"high"}]}