CVE-2026-93118

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: aspeed_udc: check endpoint DMA allocation

ast_udc_probe() allocates a coherent DMA buffer used as the backing store

for endpoint buffers. ast_udc_init_ep() derives per-endpoint buffer

pointers from udc->ep0_buf, so a failed allocation is dereferenced during

probe.

Check the allocation before endpoint setup. The existing probe error path

called ast_udc_remove(), which unregisters the gadget unconditionally and

is not safe before usb_add_gadget_udc() succeeds. Add a local cleanup

helper for probe failures so pre-registration failures only unwind the

resources that were actually initialized.

This was found by a local static analysis checker for unchecked allocator

returns while scanning Linux 6.16. The change was checked by applying it

to current mainline and by running checkpatch. I do not have access to

Aspeed UDC hardware, so no runtime testing was performed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References