CVE-2026-43250

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43250", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.996Z", "datePublished": "2026-05-06T11:28:41.158Z", "dateUpdated": "2026-10-30T12:25:18.775Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:25:18.775Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\n\nThe ChipIdea UDC driver can encounter \"not page aligned sg buffer\"\nerrors when a USB device is reconnected after being disconnected\nduring an active transfer. This occurs because _ep_nuke() returns\nrequests to the gadget layer without properly unmapping DMA buffers\nor cleaning up scatter-gather bounce buffers.\n\nRoot cause:\nWhen a disconnect happens during a multi-segment DMA transfer, the\nrequest's num_mapped_sgs field and sgt.sgl pointer remain set with\nstale values. The request is returned to the gadget driver with status\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\nthis request on reconnect without reinitializing it, the stale DMA\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\nleading to alignment errors and potential memory corruption.\n\nThe normal completion path via _hardware_dequeue() properly calls\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\nreturning the request. The _ep_nuke() path must do the same cleanup\nto ensure requests are returned in a clean, reusable state.\n\nFix:\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\nthe cleanup sequence in _hardware_dequeue():\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\n\nThis ensures that when requests are returned due to endpoint shutdown,\nthey don't retain stale DMA mappings. The 'false' parameter to\nsglist_do_debounce() prevents copying data back (appropriate for\nshutdown path where transfer was aborted)."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/chipidea/udc.c"], "versions": [{"version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "lessThan": "1497998749600411d75e60a44f7e572b2348bd9a", "status": "affected", "versionType": "git"}, {"version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "lessThan": "aad97c92119cb85db105ddda4a44c86cc0748e8c", "status": "affected", "versionType": "git"}, {"version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "lessThan": "1b72b834511d17f4d069d512f78671f3f210a2f1", "status": "affected", "versionType": "git"}, {"version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "lessThan": "f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec", "status": "affected", "versionType": "git"}, {"version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "lessThan": "e74c436f8568af1c60942469d0a2300b3ada3857", "status": "affected", "versionType": "git"}, {"version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "lessThan": "cea2a1257a3b5ea3e769a445b34af13e6aa5a123", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/chipidea/udc.c"], "versions": [{"version": "2.6.29", "status": "affected"}, {"version": "0", "lessThan": "2.6.29", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.12.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1497998749600411d75e60a44f7e572b2348bd9a"}, {"url": "https://git.kernel.org/stable/c/aad97c92119cb85db105ddda4a44c86cc0748e8c"}, {"url": "https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1"}, {"url": "https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec"}, {"url": "https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857"}, {"url": "https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123"}], "title": "usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/chipidea/udc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1497998749600411d75e60a44f7e572b2348bd9a", "status": "affected", "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "versionType": "git"}, {"lessThan": "aad97c92119cb85db105ddda4a44c86cc0748e8c", "status": "affected", "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "versionType": "git"}, {"lessThan": "1b72b834511d17f4d069d512f78671f3f210a2f1", "status": "affected", "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "versionType": "git"}, {"lessThan": "f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec", "status": "affected", "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "versionType": "git"}, {"lessThan": "e74c436f8568af1c60942469d0a2300b3ada3857", "status": "affected", "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "versionType": "git"}, {"lessThan": "cea2a1257a3b5ea3e769a445b34af13e6aa5a123", "status": "affected", "version": "aa69a8093ff985873cb44fe1157bd6db29a20fe4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/chipidea/udc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.29"}, {"lessThan": "2.6.29", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.75", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3C0B1026-23F7-4F83-B19F-153326AAEC72", "versionEndExcluding": "6.12.75", "versionStartIncluding": "2.6.29", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\n\nThe ChipIdea UDC driver can encounter \"not page aligned sg buffer\"\nerrors when a USB device is reconnected after being disconnected\nduring an active transfer. This occurs because _ep_nuke() returns\nrequests to the gadget layer without properly unmapping DMA buffers\nor cleaning up scatter-gather bounce buffers.\n\nRoot cause:\nWhen a disconnect happens during a multi-segment DMA transfer, the\nrequest's num_mapped_sgs field and sgt.sgl pointer remain set with\nstale values. The request is returned to the gadget driver with status\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\nthis request on reconnect without reinitializing it, the stale DMA\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\nleading to alignment errors and potential memory corruption.\n\nThe normal completion path via _hardware_dequeue() properly calls\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\nreturning the request. The _ep_nuke() path must do the same cleanup\nto ensure requests are returned in a clean, reusable state.\n\nFix:\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\nthe cleanup sequence in _hardware_dequeue():\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\n\nThis ensures that when requests are returned due to endpoint shutdown,\nthey don't retain stale DMA mappings. The 'false' parameter to\nsglist_do_debounce() prevents copying data back (appropriate for\nshutdown path where transfer was aborted)."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: chipidea: udc: corrige la limpieza de DMA y SG en _ep_nuke()\n\nEl controlador UDC de ChipIdea puede encontrar errores de \u2019b\u00fafer sg no alineado a p\u00e1gina\u2019 cuando un dispositivo USB se reconecta despu\u00e9s de ser desconectado durante una transferencia activa. Esto ocurre porque _ep_nuke() devuelve solicitudes a la capa de gadget sin desmapear correctamente los b\u00faferes DMA o limpiar los b\u00faferes de rebote scatter-gather.\n\nCausa ra\u00edz:\nCuando ocurre una desconexi\u00f3n durante una transferencia DMA multisegmento, el campo num_mapped_sgs de la solicitud y el puntero sgt.sgl permanecen configurados con valores obsoletos. La solicitud es devuelta al controlador de gadget con estado -ESHUTDOWN pero a\u00fan tiene un estado DMA activo. Si el controlador de gadget reutiliza esta solicitud al reconectar sin reinicializarla, el estado DMA obsoleto hace que _hardware_enqueue() omita el mapeo DMA (al ver num_mapped_sgs distinto de cero) e intente usar direcciones DMA liberadas/inv\u00e1lidas, lo que lleva a errores de alineaci\u00f3n y potencial corrupci\u00f3n de memoria.\n\nLa ruta de finalizaci\u00f3n normal a trav\u00e9s de _hardware_dequeue() llama correctamente a usb_gadget_unmap_request_by_dev() y sglist_do_debounce() antes de devolver la solicitud. La ruta _ep_nuke() debe realizar la misma limpieza para asegurar que las solicitudes se devuelvan en un estado limpio y reutilizable.\n\nSoluci\u00f3n:\nA\u00f1adir el desmapeo DMA y la limpieza del b\u00fafer de rebote a _ep_nuke() para reflejar la secuencia de limpieza en _hardware_dequeue():\n- Llamar a usb_gadget_unmap_request_by_dev() si num_mapped_sgs est\u00e1 configurado\n- Llamar a sglist_do_debounce() con copy=false si existe un b\u00fafer de rebote\n\nEsto asegura que cuando las solicitudes son devueltas debido al apagado del endpoint, no retengan mapeos DMA obsoletos. El par\u00e1metro \u2019false\u2019 de sglist_do_debounce() evita copiar datos de vuelta (apropiado para la ruta de apagado donde la transferencia fue abortada)."}], "id": "CVE-2026-43250", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-06T12:16:45.620", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1497998749600411d75e60a44f7e572b2348bd9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aad97c92119cb85db105ddda4a44c86cc0748e8c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()", "id": "2467066", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467066"}, "csaw": false, "cwe": "CWE-459", "details": ["A flaw was found in the Linux kernel's ChipIdea USB Device Controller (UDC) driver. A local user with a malicious USB device, or a malicious USB device itself, could exploit this by reconnecting the device during an active data transfer. This improper cleanup of Direct Memory Access (DMA) buffers can lead to the reuse of stale DMA states. Consequently, this can result in memory corruption, potentially causing system instability, crashes, or even arbitrary code execution."], "name": "CVE-2026-43250", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43250\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43250\nhttps://lore.kernel.org/linux-cve-announce/2026050603-CVE-2026-43250-e395@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1b72b834511d17f4d069d512f78671f3f210a2f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e74c436f8568af1c60942469d0a2300b3ada3857)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cea2a1257a3b5ea3e769a445b34af13e6aa5a123)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.75,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T14:30:05.885860+00:00", "updated": "2026-05-12T21:30:25.204564+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}