CVE-2026-90030 Overview
CVE-2026-90030 is a Linux kernel vulnerability in the DesignWare USB 3.0 (DWC3) controller driver. The flaw affects how the driver issues the EndTransfer command via the DEPCMD register. Older DWC3 programming guides recommended setting the forceRM bit to 1 when stopping an active transfer. On DWC_usb31 v2.00a and v2.10a controllers, this behavior left transfers active after EndTransfer completion. A subsequent StartTransfer on the same endpoint triggered writes tied to the aborted transfer, causing a System Memory Management Unit (SMMU) fault because the buffer had already been unmapped.
Critical Impact
A local attacker with the ability to trigger USB endpoint dequeue and restart operations can induce SMMU faults, resulting in kernel-level integrity and availability compromise on affected DWC_usb31 controllers.
Affected Products
- Linux kernel usb: dwc3 driver on systems using DWC_usb31 v2.00a controllers
- Linux kernel usb: dwc3 driver on systems using DWC_usb31 v2.10a controllers
- Linux kernel stable branches prior to the fixes referenced in commits 0afe5c3, b58e620, and e01408e
Discovery Timeline
- 2026-09-16 - CVE-2026-90030 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90030
Vulnerability Analysis
The DWC3 driver manages USB transfers through commands written to the DEPCMD register. The EndTransfer command stops an active transfer on a specific endpoint. The forceRM bit within that command controls whether the controller forcibly releases resources during teardown. When set to 1 on DWC_usb31 v2.00a and v2.10a hardware, the transfer state was not fully torn down after the command completed.
The driver unmaps the transfer buffer during EndTransfer command-completion cleanup. If a subsequent StartTransfer is issued on the same endpoint, the controller performs writes tied to the previously aborted transfer. These writes reference addresses that are no longer mapped in the IOMMU, producing an SMMU fault. This is a memory safety flaw affecting kernel-controlled DMA operations.
Root Cause
The root cause is inconsistent handling of the forceRM bit against newer DWC_usb31 controller behavior. Older programming guide revisions instructed setting forceRM=1, but newer hardware revisions require it cleared. The mismatch between driver behavior and hardware expectations creates a window where controller state and driver state diverge, leaving stale transfer descriptors active after unmap.
Attack Vector
Exploitation requires local access with privileges sufficient to interact with USB endpoint operations that trigger the ep_dequeue path followed by a new transfer submission. The consequence is an SMMU fault that can compromise confidentiality, integrity, and availability of kernel memory operations on affected controllers. No network vector or user interaction is required.
// No verified public exploit code is available.
// See the referenced kernel commits for the corrective change:
// - git.kernel.org commit 0afe5c31612de3d18cc6d16e616da4a48ba1e5a2
// - git.kernel.org commit b58e6200450d350314db0ecda7d6d1bde3281e80
// - git.kernel.org commit e01408ee52fe5cb2d0b43f47f359336af2b6c316
Detection Methods for CVE-2026-90030
Indicators of Compromise
- SMMU fault entries in kernel logs referencing DWC3 endpoint addresses or unmapped DMA regions
- dmesg warnings mentioning dwc3EndTransfer completion followed by fault events
- Repeated USB endpoint reset sequences on DWC_usb31 v2.00a or v2.10a hardware
Detection Strategies
- Monitor kernel ring buffer output for IOMMU fault messages correlated with dwc3_ep_dequeue call paths
- Audit installed kernel versions against the stable branches containing commits 0afe5c3, b58e620, and e01408e
- Track USB stack error rates on embedded and mobile platforms that use DWC_usb31 IP
Monitoring Recommendations
- Forward dmesg and journald kernel facility logs to a centralized analytics platform for pattern correlation
- Alert on SMMU or ARM IOMMU fault codes reported by kernel subsystems
- Baseline USB error telemetry on production devices to surface anomalous EndTransfer sequences
How to Mitigate CVE-2026-90030
Immediate Actions Required
- Apply the upstream kernel patches referenced in the Kernel Git Commit 0afe5c3, Kernel Git Commit b58e620, and Kernel Git Commit e01408e
- Rebuild and redeploy kernels for embedded devices, mobile platforms, and SoCs using DWC_usb31 IP
- Restrict local access on affected systems until patches are deployed
Patch Information
The fix clears the forceRM bit when issuing EndTransfer, aligning the driver with the newer DWC3 programming guide. The change is applied in the mainline kernel and backported through the referenced stable commits. Distribution maintainers should pull the fix into supported LTS branches.
Workarounds
- No supported software-only workaround exists; the fix requires the kernel patch
- Limit exposure by minimizing local users with permissions to manipulate USB gadget or endpoint operations
- Disable USB gadget functionality on affected devices where operationally acceptable until patched
# Verify installed kernel version and check for the fix
uname -r
git log --oneline | grep -E "0afe5c3|b58e620|e01408e"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
