UBUNTU-CVE-2026-90030: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when issuing EndTransfer The forceRM bit of the DEPCMD register controls the behavior of the EndTransfer command used to stop an active transfer. Older DWC3 programming guide revisions recommended setting forceRM=1 when issuing EndTransfer. Newer programming guide revisions recommend issuing EndTransfer with forceRM cleared. With forceRM=1 on DWCusb31 v2.00a and v2.10a controllers, a transfer aborted through the epdequeue path was observed to remain active after EndTransfer completion. A subsequent StartTransfer issued on the same endpoint triggered writes associated with the aborted transfer. This resulted in an SMMU fault because the transfer buffer had already been unmapped during EndTransfer command-completion cleanup. Using forceRM=0 eliminates the issue. Although older DWC3 programming guide revisions recommended setting forceRM=1, no issues are known from using forceRM=0. Clear forceRM when issuing EndTransfer to provide consistent EndTransfer behavior and align with newer programming guide recommendations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Clear forceRM when issuing the EndTransfer command; use forceRM=0 to align with newer DWC3 programming guide recommendations and avoid the observed transfer and SMMU-fault issues.
Linux kernel USB DWC3 forceRM = 0
Event History
Frequently Asked Questions
Which systems are affected by the observed failure mode?
The issue was observed on DWC_usb31 v2.00a and v2.10a controllers. The listed Ubuntu kernel packages are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.
What conditions trigger the problem?
An active USB transfer must be aborted through the ep_dequeue path while EndTransfer is issued with forceRM=1. If a new StartTransfer is then issued on the same endpoint, the controller can write for the aborted transfer after its buffer has been unmapped.
How might an affected system show evidence of this issue?
The described outcome is an SMMU fault caused by writes associated with the aborted transfer to a buffer that was already unmapped during EndTransfer completion cleanup.
What is the mitigation if the fix cannot be deployed immediately?
Issue EndTransfer with the forceRM bit cleared (forceRM=0). The available data states that this eliminates the issue and that no issues are known from using forceRM=0.