Linux Kernel Vulnerability in DWC3 USB Controllers

CVE-2026-90030

What is CVE-2026-90030?

A vulnerability in the Linux kernel's DWC3 USB controllers arises due to an incorrect implementation of the EndTransfer command. The forceRM bit in the DEPCMD register, which was previously set to 1 according to outdated programming guidelines, can lead to unwanted behaviors during active data transfers. When EndTransfer is issued with forceRM=1, aborted transfers may remain active, resulting in subsequent commands causing system faults. To mitigate this issue, the forceRM bit should be cleared when issuing the EndTransfer command, aligning the implementation with updated programming recommendations and ensuring reliable transfer termination.

References