CVE-2026-93118: usb: gadget: aspeed_udc: check endpoint DMA allocation
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: aspeedudc: check endpoint DMA allocation
astudcprobe() allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep() derives per-endpoint buffer pointers from udc->ep0buf, so a failed allocation is dereferenced during probe.
Check the allocation before endpoint setup. The existing probe error path called astudcremove(), which unregisters the gadget unconditionally and is not safe before usbaddgadgetudc() succeeds. Add a local cleanup helper for probe failures so pre-registration failures only unwind the resources that were actually initialized.
This was found by a local static analysis checker for unchecked allocator returns while scanning Linux 6.16. The change was checked by applying it to current mainline and by running checkpatch. I do not have access to Aspeed UDC hardware, so no runtime testing was performed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.188 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Compensating control
In ast_udc_probe(), check the coherent DMA allocation used for endpoint buffers before endpoint setup, and use a local cleanup helper for probe failures so only resources that were initialized are unwound; do not call ast_udc_remove() before usb_add_gadget_udc() succeeds.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems that probe the Aspeed UDC gadget driver are exposed if allocation of its coherent DMA endpoint buffer fails during probe. The failure occurs before the gadget controller has been successfully registered.
What is the result of the allocation failure?
The driver can derive endpoint buffer pointers from a failed DMA allocation and dereference them during probe. Its previous probe error path could also call gadget-unregistration cleanup before registration had succeeded.