{"id":"CVE-2026-90030","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-90030","summary":"usb: dwc3: clear forceRM when issuing EndTransfer","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: clear forceRM when issuing EndTransfer\n\nThe forceRM bit of the DEPCMD register controls the behavior of the\nEndTransfer command used to stop an active transfer. Older DWC3\nprogramming guide revisions recommended setting forceRM=1 when\nissuing EndTransfer. Newer programming guide revisions recommend\nissuing EndTransfer with forceRM cleared.\n\nWith forceRM=1 on DWC_usb31 v2.00a and v2.10a controllers, a transfer\naborted through the ep_dequeue path was observed to remain active\nafter EndTransfer completion. A subsequent StartTransfer issued on the\nsame endpoint triggered writes associated with the aborted transfer.\nThis resulted in an SMMU fault because the transfer buffer had already\nbeen unmapped during EndTransfer command-completion cleanup.\n\nUsing forceRM=0 eliminates the issue. Although older DWC3 programming\nguide revisions recommended setting forceRM=1, no issues are known\nfrom using forceRM=0. Clear forceRM when issuing EndTransfer to provide\nconsistent EndTransfer behavior and align with newer programming guide\nrecommendations.","published":"2026-09-16T10:33:31.801Z","modified":"2026-09-17T03:47:27.554192802Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.18.51"}],"fix":null,"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0afe5c31612de3d18cc6d16e616da4a48ba1e5a2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b58e6200450d350314db0ecda7d6d1bde3281e80"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e01408ee52fe5cb2d0b43f47f359336af2b6c316"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90030.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90030"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-17T03:47:27.554192802Z"}}