CVE-2026-90030

7.8 HIGH

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: This vulnerability in the DWC3 USB controller causes an SMMU fault when an EndTransfer command is issued with forceRM=1, leading to inconsistent behavior and potential data corruption.
Exploitability: Exploitation requires specific conditions, including the use of forceRM=1 with DWC_usb31 v2.00a and v2.10a controllers, making it moderately difficult to exploit.
Blast radius: If exploited, this could result in data corruption and system instability, impacting devices using these DWC3 controllers.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to DWC3 v2.11 or later to address this issue.

usbcontrollersmmucorruption

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when issuing EndTransfer The forceRM bit of the DEPCMD register controls the behavior of the EndTransfer command used to stop an active transfer. Older DWC3 programming guide revisions recommended setting forceRM=1 when issuing EndTransfer. Newer programming guide revisions recommend issuing EndTransfer with forceRM cleared. With forceRM=1 on DWC_usb31 v2.00a and v2.10a controllers, a transfer aborted through the ep_dequeue path was observed to remain active after EndTransfer completion. A subsequent StartTransfer issued on the same endpoint triggered writes associated with the aborted transfer. This resulted in an SMMU fault because the transfer buffer had already been unmapped during EndTransfer command-completion cleanup. Using forceRM=0 eliminates the issue. Although older DWC3 programming guide revisions recommended setting forceRM=1, no issues are known from using forceRM=0. Clear forceRM when issuing EndTransfer to provide consistent EndTransfer behavior and align with newer programming guide recommendations.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.