Cloudanix VulnDB

CVE-2026-93118

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A USB driver in the Linux kernel can crash the whole system if a memory request fails during startup on certain Aspeed hardware.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Unchecked return value from coherent DMA buffer allocation in ast_udc_probe allows subsequent dereference of a null ep0_buf pointer inside ast_udc_init_ep, producing a kernel memory corruption or NULL dereference during device initialization.

Why it matters to the business

Systems using the Aspeed UDC USB gadget driver may experience kernel crashes or instability at USB controller probe time; low exploitability and narrow hardware scope limit widespread operational impact.

How an attack unfolds

An attacker with local access triggers USB gadget driver loading or device enumeration on affected Aspeed hardware; the failed allocation is not checked, causing the kernel to dereference an invalid pointer during endpoint setup and resulting in a crash or potential memory corruption.

How to fix it

Apply the upstream fix that adds an allocation check before endpoint initialization and introduces a local cleanup helper for probe failures; rebuild and deploy the patched kernel on affected systems.

How to confirm the fix worked

Confirm the presence of the allocation check and local cleanup helper in the aspeed_udc probe path; verify that probe failures no longer unconditionally call ast_udc_remove before usb_add_gadget_udc succeeds.

Typical attack path

  1. Obtain local access to a system containing Aspeed UDC hardware
  2. Trigger loading of the aspeed_udc gadget driver or USB device enumeration
  3. Force a DMA allocation failure during ast_udc_probe
  4. Trigger dereference of the uninitialized ep0_buf pointer inside ast_udc_init_ep
  5. Cause kernel panic or memory corruption

How to detect it

Review kernel logs around USB gadget or aspeed_udc probe events for allocation failure messages or NULL pointer dereference oops; inspect dmesg and journalctl for ast_udc_init_ep or ep0_buf references.

What your security team should do

  • Prioritize patching systems that expose the Aspeed UDC gadget driver
  • Monitor kernel logs for allocation-related failures during USB gadget initialization
  • Apply the fix even on systems without the specific hardware because the code path is compiled in

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed_udc: check endpoint DMA allocation ast_udc_probe() allocates a coherent DMA buffer used as the backing store for endpoint buffers. ast_udc_init_ep() derives per-endpoint buffer pointers from udc->ep0_buf, so a failed allocation is dereferenced during probe. Check the allocation before endpoint setup. The existing probe error path called ast_udc_remove(), which unregisters the gadget unconditionally and is not safe before usb_add_gadget_udc() succeeds. Add a local cleanup helper for probe failures so pre-registration failures only unwind the resources that were actually initialized. This was found by a local static analysis checker for unchecked allocator returns while scanning Linux 6.16. The change was checked by applying it to current mainline and by running checkpatch. I do not have access to Aspeed UDC hardware, so no runtime testing was performed.

Affected packages

Ecosystem Package Introduced Fixed