CVE-2026-93118: usb: gadget: aspeed_udc: check endpoint DMA allocation
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: aspeedudc: check endpoint DMA allocation
astudcprobe() allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep() derives per-endpoint buffer pointers from udc->ep0buf, so a failed allocation is dereferenced during probe.
Check the allocation before endpoint setup. The existing probe error path called astudcremove(), which unregisters the gadget unconditionally and is not safe before usbaddgadgetudc() succeeds. Add a local cleanup helper for probe failures so pre-registration failures only unwind the resources that were actually initialized.
This was found by a local static analysis checker for unchecked allocator returns while scanning Linux 6.16. The change was checked by applying it to current mainline and by running checkpatch. I do not have access to Aspeed UDC hardware, so no runtime testing was performed.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems that probe the Aspeed UDC gadget driver are exposed if allocation of its coherent DMA endpoint buffer fails during probe. The failure occurs before the gadget controller has been successfully registered.
What is the result of the allocation failure?
The driver can derive endpoint buffer pointers from a failed DMA allocation and dereference them during probe. Its previous probe error path could also call gadget-unregistration cleanup before registration had succeeded.