CVE-2026-90015

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xHCI driver where Transfer Descriptors (TDs) spanning three or more ring segments can lead to lost bounce buffers. When a TD is not aligned to the endpoint's wMaxPacketSize, the xhci align td() function stages the unalignable tail through a bounce buffer. However, the system incorrectly assumes a TD never spans more than two ring segments, recording only the last bounced segment in td->bounce seg.

As a result, earlier bounce buffers are neither copied back to the USB Request Block (URB) buffer nor DMA unmapped. This causes a DMA mapping leak and leaves holes of stale data in the destination buffer, even though the transfer is reported as successful. This can be triggered by large and fragmented bulk transfers, such as those used by USB mass storage devices backing a dm-verity target.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.