CVE-2026-90030

A flaw was found in the Linux kernel's DWC3 USB controller driver. When the forceRM bit is incorrectly set during an EndTransfer command, a transfer may remain active even after completion. A subsequent StartTransfer on the same endpoint can then trigger writes to an unmapped memory buffer, leading to a System Memory Management Unit (SMMU) fault. This issue can result in system instability or a denial of service.

An EndTransfer state handling flaw in the DWC3 USB gadget driver can leave an aborted transfer active when forceRM is set on DWC_usb31 v2.00a and v2.10a controllers. After ep_dequeue cleanup has unmapped the transfer buffer, a later StartTransfer on the same endpoint may still cause controller writes associated with the aborted transfer. The observed result is an SMMU fault and kernel denial of service, and on systems without effective DMA isolation the same pattern is a plausible DMA use after unmap memory-corruption candidate. For the CVSS the PR:N is used because a USB host does not need credentials on the gadget device, but physical USB attachment is required and this is not IP network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.