CVE-2026-93118 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: aspeed_udc: check endpoint DMA allocation
ast_udc_probe() allocates a coherent DMA buffer used as the backing store for endpoint buffers. ast_udc_init_ep() derives per-endpoint buffer pointers from udc->ep0_buf, so a failed allocation is dereferenced during probe.
Check the allocation before endpoint setup. The existing probe error path called ast_udc_remove(), which unregisters the gadget unconditionally and is not safe before usb_add_gadget_udc() succeeds. Add a local cleanup helper for probe failures so pre-registration failures only unwind the resources that were actually initialized.
This was found by a local static analysis checker for unchecked allocator returns while scanning Linux 6.16. The change was checked by applying it to current mainline and by running checkpatch. I do not have access to Aspeed UDC hardware, so no runtime testing was performed.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Linux kernel's USB gadget subsystem for ASPEED controllers represents a critical resource management flaw within the device controller driver initialization sequence. Specifically, this issue resides in the ast_udc_probe function which is responsible for setting up the Universal Device Controller hardware and its associated software structures to enable USB peripheral functionality on Aspeed SoCs. During the probe phase, the kernel attempts to allocate a coherent DMA buffer that serves as the backing store for endpoint buffers used during data transfer operations. The core technical flaw lies in the lack of validation for this allocation operation; if the memory allocator fails due to system resource exhaustion or fragmentation, the subsequent code proceeds without verifying whether the pointer returned by the allocation function is valid. This unchecked return value leads directly to a null pointer dereference when ast_udc_init_ep attempts to derive per-endpoint buffer pointers from the potentially NULL udc->ep0_buf field. Such an error typically results in a kernel panic or system crash, effectively causing a denial of service for the host machine running the Linux operating system.
From a technical perspective, this vulnerability is classified under CWE-252 which covers unchecked return value errors, and more specifically aligns with CWE-476 regarding NULL pointer dereferences. The attack vector is local, requiring an attacker to have some level of access to trigger conditions that cause memory allocation failures during the driver initialization process. While often triggered by resource pressure rather than malicious input manipulation per se, this flaw can be exploited in scenarios where an adversary aims to destabilize a system or disrupt critical USB-based peripheral connectivity. The absence of proper error handling means that any condition leading to insufficient kernel memory will immediately compromise system stability at the point of driver loading. This is particularly dangerous because it occurs early in the boot or module insertion process, potentially preventing the device from ever becoming operational and leaving the system in an unstable state requiring a reboot.
The mitigation strategy implemented addresses both the immediate crash vector and broader architectural issues within the probe error handling path. The primary fix involves adding explicit checks for the DMA allocation return value before proceeding with endpoint setup. If the allocation fails, the driver now aborts initialization gracefully rather than attempting to use invalid memory pointers. Furthermore, the original implementation contained a secondary flaw where the existing probe error path unconditionally called ast_udc_remove(). This function is designed to unregister the gadget and clean up resources but was not safe to invoke before usb_add_gadget_udc() has successfully completed its registration process. Calling removal routines on an incompletely initialized structure can lead to use-after-free conditions or other undefined behaviors as it attempts to access data structures that may not have been fully set up or are in a transitional state.
To resolve this, the developers introduced a local cleanup helper specifically tailored for probe failures. This ensures that only resources that were actually successfully initialized during the early stages of probing are unwound and freed if an error occurs later in the sequence. This approach adheres to best practices in kernel driver development by maintaining strict symmetry between initialization steps and their corresponding teardown routines. By restricting the cleanup scope to only what was allocated, the risk of accessing uninitialized or already-freed memory is eliminated. This change enhances the robustness of the driver against resource exhaustion scenarios and ensures that partial initializations do not leave the system in an inconsistent state. The fix has been validated through static analysis tools scanning Linux 6.16 codebases and verified via checkpatch compliance, although runtime testing on actual Aspeed hardware was not performed due to access limitations. Nevertheless, the logical correctness of the patch aligns with established kernel coding standards for error handling and resource management in device drivers.