CVE-2026-43250: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43250 Overview

CVE-2026-43250 is a Linux kernel vulnerability in the ChipIdea USB Device Controller (UDC) driver. The flaw resides in _ep_nuke(), which fails to unmap Direct Memory Access (DMA) buffers and clean up scatter-gather (SG) bounce buffers when a USB transfer is aborted. When a USB device disconnects mid-transfer and later reconnects, the gadget driver can reuse a request that still carries stale DMA state. This causes _hardware_enqueue() to skip DMA mapping and operate on freed or invalid DMA addresses, producing "not page aligned sg buffer" errors and potential memory corruption.

Critical Impact
Stale DMA mappings retained after USB disconnect can lead to use of freed DMA addresses and kernel memory corruption on affected ChipIdea UDC hardware.

Affected Products

Linux kernel — drivers/usb/chipidea/udc.c (ChipIdea UDC driver)
Stable kernel branches receiving the backports referenced in the kernel.org commits
Systems using ChipIdea USB device controller hardware in gadget mode

Discovery Timeline

2026-05-06 - CVE-2026-43250 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43250

Vulnerability Analysis

The ChipIdea UDC driver returns in-flight requests to the gadget layer through _ep_nuke() when an endpoint is shut down. Unlike the normal completion path in _hardware_dequeue(), this shutdown path does not invoke usb_gadget_unmap_request_by_dev() or sglist_do_debounce(). Requests are returned with status -ESHUTDOWN while their num_mapped_sgs field and sgt.sgl pointer still reference DMA mappings and bounce buffers that have been torn down.

When the gadget driver later reuses such a request after reconnection, _hardware_enqueue() inspects num_mapped_sgs, finds it non-zero, and assumes the buffers are already mapped. The driver then programs the controller using stale physical addresses. This produces alignment faults reported as "not page aligned sg buffer" and exposes memory previously released by the DMA layer to controller writes.

Root Cause

The root cause is asymmetric cleanup between two request-completion paths in the same driver. _hardware_dequeue() performs full DMA teardown, while _ep_nuke() only detaches the request from the endpoint queue. The request structure therefore retains stale num_mapped_sgs and sgt.sgl values, violating the gadget API contract that returned requests must be in a clean, reusable state.

Attack Vector

The condition is reached by disconnecting a USB device during an active multi-segment DMA transfer and then reconnecting it. Physical access or control over a peripheral capable of triggering disconnect events during data transfer is required. Repeated disconnect-reconnect cycles increase the probability of triggering the stale DMA reuse and resulting memory corruption.

No verified exploit code is published. The fix, applied across the commits referenced below, mirrors the cleanup sequence from _hardware_dequeue() inside _ep_nuke() by calling usb_gadget_unmap_request_by_dev() when num_mapped_sgs is set and sglist_do_debounce() with copy=false when a bounce buffer exists. See the Kernel Git Commit f4fbf2d and the Kernel Git Commit e74c436 for the patch content.

Detection Methods for CVE-2026-43250

Indicators of Compromise

Kernel log entries containing the string not page aligned sg buffer originating from the ChipIdea UDC driver.
DMA-API debug warnings referencing usb_gadget_unmap_request_by_dev or unmapped buffer reuse on USB endpoints.
Repeated -ESHUTDOWN request completions correlated with subsequent USB enumeration failures.

Detection Strategies

Monitor dmesg and kernel ring buffer telemetry for ChipIdea UDC alignment errors after USB disconnect events.
Enable CONFIG_DMA_API_DEBUG in test environments to surface stale DMA mapping reuse during USB disconnect-reconnect testing.
Track installed kernel package versions and compare against the fixed commits listed in the Kernel Git Commit 1b72b83 and Kernel Git Commit cea2a12 references.

Monitoring Recommendations

Forward kernel logs from embedded and industrial systems that use ChipIdea-based USB controllers to a centralized log platform for pattern detection.
Alert on kernel oops, BUG, or page fault entries that occur shortly after USB hotplug events.
Track firmware and kernel build inventory for devices in gadget mode that depend on the ci_hdrc driver.

How to Mitigate CVE-2026-43250

Immediate Actions Required

Apply vendor kernel updates that include the upstream fix to _ep_nuke() in drivers/usb/chipidea/udc.c.
Inventory devices using ChipIdea UDC hardware, including embedded boards and SoCs operating in USB gadget or peripheral mode.
Restrict physical access on systems where a kernel update cannot yet be deployed, since triggering the flaw requires USB disconnect events.

Patch Information

The upstream fix adds DMA unmapping and bounce buffer cleanup to _ep_nuke() so it mirrors _hardware_dequeue(). The patch calls usb_gadget_unmap_request_by_dev() when num_mapped_sgs is non-zero and invokes sglist_do_debounce() with copy=false to avoid copying back data from an aborted transfer. Backports are available in the Kernel Git Commit 1b72b83, Kernel Git Commit cea2a12, Kernel Git Commit e74c436, and Kernel Git Commit f4fbf2d.

Workarounds

Avoid disconnecting USB peripherals during active multi-segment transfers on unpatched ChipIdea-based systems.
Where feasible, disable or unbind the ci_hdrc driver on systems that do not require USB gadget functionality.
Validate downstream gadget drivers reset num_mapped_sgs and sgt.sgl before reusing requests that completed with -ESHUTDOWN.

bash

# Verify the running kernel and ChipIdea driver status
uname -r
lsmod | grep ci_hdrc
# Inspect kernel log for ChipIdea alignment errors
dmesg | grep -i "not page aligned sg buffer"