{"id":"CVE-2026-90030","published":"2026-09-16T11:17:16.070","lastModified":"2026-09-16T15:18:26.160","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: clear forceRM when issuing EndTransfer\n\nThe forceRM bit of the DEPCMD register controls the behavior of the\nEndTransfer command used to stop an active transfer. Older DWC3\nprogramming guide revisions recommended setting forceRM=1 when\nissuing EndTransfer. Newer programming guide revisions recommend\nissuing EndTransfer with forceRM cleared.\n\nWith forceRM=1 on DWC_usb31 v2.00a and v2.10a controllers, a transfer\naborted through the ep_dequeue path was observed to remain active\nafter EndTransfer completion. A subsequent StartTransfer issued on the\nsame endpoint triggered writes associated with the aborted transfer.\nThis resulted in an SMMU fault because the transfer buffer had already\nbeen unmapped during EndTransfer command-completion cleanup.\n\nUsing forceRM=0 eliminates the issue. Although older DWC3 programming\nguide revisions recommended setting forceRM=1, no issues are known\nfrom using forceRM=0. Clear forceRM when issuing EndTransfer to provide\nconsistent EndTransfer behavior and align with newer programming guide\nrecommendations.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/0afe5c31612de3d18cc6d16e616da4a48ba1e5a2","tags":[]},{"url":"https://git.kernel.org/stable/c/b58e6200450d350314db0ecda7d6d1bde3281e80","tags":[]},{"url":"https://git.kernel.org/stable/c/e01408ee52fe5cb2d0b43f47f359336af2b6c316","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}