CVE-2026-43250

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()

The ChipIdea UDC driver can encounter "not page aligned sg buffer"

errors when a USB device is reconnected after being disconnected

during an active transfer. This occurs because _ep_nuke() returns

requests to the gadget layer without properly unmapping DMA buffers

or cleaning up scatter-gather bounce buffers.

Root cause:

When a disconnect happens during a multi-segment DMA transfer, the

request's num_mapped_sgs field and sgt.sgl pointer remain set with

stale values. The request is returned to the gadget driver with status

-ESHUTDOWN but still has active DMA state. If the gadget driver reuses

this request on reconnect without reinitializing it, the stale DMA

state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero

num_mapped_sgs) and attempt to use freed/invalid DMA addresses,

leading to alignment errors and potential memory corruption.

The norma

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References