CVE-2026-90030

The Linux kernel's DWC3 USB controller driver issued EndTransfer commands with the forceRM bit set, as older Synopsys programming guides recommended; on DWC_usb31 v2.00a and v2.10a controllers this leaves an aborted transfer active after the EndTransfer command completes. A local attacker who can trigger an endpoint dequeue (the ep_dequeue path) followed by a new StartTransfer on the same endpoint can cause the controller to DMA into a buffer that has already been unmapped, producing an SMMU (IOMMU) fault. The practical result is a kernel crash/denial of service, and the 7.8 High CVSS score (C:H/I:H/A:H) reflects potential memory-safety impact from stale DMA writes. Any Linux system whose silicon uses Synopsys DWC_usb31 v2.00a or v2.10a with the DWC3 driver is affected, which includes many ARM SoCs in Android phones, development boards, and embedded/gadget-mode devices. No public proof-of-concept is known, the issue is not in CISA's KEV, and no in-the-wild exploitation has been reported.

What to do: Update Linux systems using DWC3 to a kernel that includes the fix commit ('usb: dwc3: clear forceRM when issuing EndTransfer'); no fixed release number is provided in the data, so pull the latest stable or vendor kernel. Operators of ARM/embedded, OTG, or USB-gadget systems should verify whether their SoC integrates Synopsys DWC_usb31 v2.00a or v2.10a (check SoC documentation or controller revision registers) and limit local untrusted user access, since exploitation requires local code execution. No workarounds, public PoCs, or in-the-wild exploitation are currently known.