CVE-2026-90015

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xhci: fix lost bounce buffers on TDs spanning several ring segments

When a TD reaches a link TRB with data that is not aligned to the

endpoint's wMaxPacketSize, xhci_align_td() stages the unalignable tail

through the bounce buffer of the ring segment holding that link TRB.

xhci_unmap_td_bounce_buffer() later unmaps it and, for IN transfers,

copies the data back into the URB's buffer.

The enqueue path records the segment that was bounced in td->bounce_seg,

under the assumption that a TD never spans more than two ring segments.

That assumption does not hold: a TD large enough to span three or more

segments crosses several link TRBs and can be bounced at each of them.

Only the last one survives in td->bounce_seg, so every earlier bounce

buffer is neither copied back nor DMA unmapped.

The URB still completes with actual_length equal to the requested length

and no error, so the transfer looks successful while a wMaxPack

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References