CVE-2026-43250

What it actually does

This Linux kernel flaw affects the ChipIdea USB Device Controller gadget driver. When a USB connection is disconnected during an active multi-segment DMA transfer, the endpoint shutdown path can return a request to the gadget layer without unmapping DMA buffers or cleaning scatter-gather bounce-buffer state. If the same request object is reused after reconnect, stale DMA metadata can cause the driver to skip remapping and operate on freed, invalid, or incorrectly aligned DMA addresses. The result can be kernel memory corruption, kernel crash, or potentially privilege escalation from a local context on systems exposing the affected USB gadget/device-controller path.

Why it matters to the business

Systems using Linux with ChipIdea USB gadget/device-controller hardware may be destabilized or compromised by a local attacker or by abuse of physical USB attach/detach behavior during active transfers. The most likely operational impact is device crash, service interruption, or unreliable USB gadget functionality; in a worst case, the memory corruption could be used to gain elevated privileges on the affected device. This is most relevant to embedded Linux, IoT, mobile, appliance, and specialized hardware platforms that use the ChipIdea UDC driver. The issue is not listed in CISA KEV, has no known public exploit maturity in the provided data, and has a low EPSS score, so remediation should be prioritized based on actual use of the affected driver and physical/local access exposure.

How an attack unfolds

An attacker needs local access to the affected system or a way to interact with the system’s USB gadget/device-controller interface. They initiate or cause a multi-segment DMA transfer through the ChipIdea UDC gadget path, then trigger a disconnect while the transfer is still active. The vulnerable endpoint shutdown logic returns the request to the gadget layer with shutdown status but leaves DMA and scatter-gather state behind. After reconnect, if the gadget driver reuses the same request without full reinitialization, the hardware enqueue path sees stale mapping metadata and may use invalid DMA addresses instead of creating fresh mappings. This can produce kernel errors such as unaligned scatter-gather buffers, crash the kernel, or create memory corruption conditions that a capable local attacker may attempt to shape into privilege escalation.

How to fix it

Apply a Linux kernel update that includes the ChipIdea UDC fix for endpoint shutdown cleanup in drivers/usb/chipidea/udc.c. The corrected behavior unmaps DMA state with usb_gadget_unmap_request_by_dev() when num_mapped_sgs is set and cleans scatter-gather bounce buffers with sglist_do_debounce(..., false) during _ep_nuke(). If vendor fixed package versions are not yet available, track the relevant distribution, device-vendor, or BSP kernel advisory and update as soon as a patched kernel is released. Where immediate patching is not possible, reduce exposure by disabling unused USB gadget functionality, disabling or unloading the ChipIdea UDC driver where feasible, restricting physical access to affected devices, and avoiding untrusted USB interactions. Embedded and appliance vendors should backport the upstream kernel fix into maintained product kernels and validate USB disconnect/reconnect behavior under active transfer load.

How to confirm the fix worked

Confirm whether the running kernel includes the fix by reviewing the vendor kernel changelog, distribution security advisory, or source tree for the ChipIdea UDC _ep_nuke() cleanup changes in drivers/usb/chipidea/udc.c. On systems with source or debug symbols available, verify that the endpoint shutdown path calls usb_gadget_unmap_request_by_dev() for mapped scatter-gather requests and invokes sglist_do_debounce() without copying data back during shutdown. Confirm whether the affected driver is present or loaded by checking kernel configuration and modules for ChipIdea UDC support, such as CONFIG_USB_CHIPIDEA_UDC, ci_hdrc, or related platform modules. Functional validation should include repeated USB gadget transfers followed by forced disconnect/reconnect cycles while monitoring dmesg or journal logs for DMA, scatter-gather, alignment, or kernel oops messages. Successful remediation should eliminate recurring "not page aligned sg buffer" errors and avoid crashes during active-transfer disconnect testing.

Typical attack path

1. Obtain local access to a vulnerable Linux device or physical/logical access to its USB gadget/device-controller interface.
2. Identify that the system uses the ChipIdea UDC driver and supports USB gadget functionality.
3. Start a USB gadget transfer that uses multi-segment DMA or scatter-gather buffers.
4. Disconnect or force endpoint shutdown while the transfer is still active.
5. Reconnect or cause the gadget function to reuse the previously returned request object.
6. Trigger the vulnerable enqueue path, causing stale DMA or bounce-buffer state to be reused.
7. Leverage the resulting kernel memory corruption for denial of service or, if exploit primitives are reliable, local privilege escalation.

How to detect it

Retrospective detection should focus on kernel and system logs because exploitation would occur in kernel space and may leave few user-space artifacts. Review dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, crash dumps, pstore records, and vendor device logs for USB gadget disconnect/reconnect cycles followed by DMA, scatter-gather, alignment, kernel oops, panic, or general protection fault messages. Correlate these events with physical access records, device management logs, USB cable insert/remove telemetry if available, and unexpected device reboots. Look for repeated active-transfer disconnect patterns involving ChipIdea/ci_hdrc/UDC components. Absence of these logs does not prove non-exploitation, because successful memory corruption may not produce stable artifacts; however, recurring "not page aligned sg buffer" or ci_hdrc errors around reconnect events are strong signals that the vulnerable path was exercised.

• not page aligned sg buffer
• ci_hdrc
• ChipIdea
• chipidea
• UDC
• udc
• usb gadget
• gadget driver
• -ESHUTDOWN
• num_mapped_sgs
• sglist_do_debounce
• usb_gadget_unmap_request_by_dev
• drivers/usb/chipidea/udc.c
• kernel BUG
• kernel panic
• Oops:
• general protection fault
• DMA-API
• scatter-gather
• sg buffer

What your security team should do

• Inventory Linux systems, embedded devices, appliances, and development boards that use USB gadget mode with ChipIdea UDC hardware or the ci_hdrc/ChipIdea driver stack.
• Prioritize patching for devices that are physically accessible to untrusted users, deployed in field environments, or expose USB gadget functionality as part of normal operations.
• Apply vendor or distribution kernel updates when available; for custom kernels, backport the upstream ChipIdea UDC _ep_nuke() DMA unmap and scatter-gather cleanup fix.
• Temporarily disable unused USB gadget functions or restrict physical USB access where patching is delayed.
• Monitor kernel logs for ChipIdea UDC, DMA mapping, scatter-gather alignment, endpoint shutdown, kernel oops, or panic messages following USB disconnect/reconnect events.
• Add regression testing for active USB transfer interruption, disconnect, and reconnect behavior in embedded product QA pipelines.
• Treat suspicious crashes that coincide with repeated USB connect/disconnect activity as potential exploitation attempts, especially on devices in physically exposed locations.