CVE Intelligence
Unknown

CVE-2026-90015 — xhci: fix lost bounce buffers on TDs spanning several ring segments

In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, xhci_align_td() stages the unalignable tail through the bounce buffer of the ring segment holding that link TRB. xhci_unmap_td_bounce_buffer() later unmaps it and, for IN transfers, copies the data back into the URB's buffer. The enqueue path records the segment that was bounced in td->bounce_seg, under the assumption that a TD never spans more than two ring segments. That assumption does not hold: a TD large enough to span three or more segments crosses several link TRBs and can be bounced at each of them. Only the last one survives in td->bounce_seg, so every earlier bounce buffer is neither copied back nor DMA unmapped. The URB still completes with actual_length equal to the requested length and no error, so the transfer looks successful while a wMaxPacketSize sized hole in the destination buffer silently keeps its previous contents. It also leaks a DMA mapping per dropped bounce. Any sufficiently large and fragmented bulk transfer can hit this. It was found with a USB mass storage device behind xHCI backing a dm-verity target with 512 byte hash blocks, where the stale data is detected rather than silently consumed. The device enumerates as SuperSpeed, so wMaxPacketSize is 1024, while dm-bufio issues one 512 byte bio per hash block. verity_prefetch_io() makes the block layer merge hundreds of them into a single request of up to 512 scatterlist entries of 512 bytes each. At 256 TRBs per ring segment such a TD spans three segments, and every segment boundary falls on an odd multiple of 512, i.e. unaligned to wMaxPacketSize. dm-bufio then caches a hash block holding stale data and dm-verity declares the metadata block corrupted: device-mapper: verity: 8:2: metadata block 10850 is corrupted A reproducer running this under qemu is available at https://github.com/baloo/xhci-verity The bounce state (bounce_buf, bounce_dma, bounce_len, bounce_offs) already lives on the ring segment, so there is nothing extra to track. Keep recording the last bounced segment in td->bounce_seg and, on completion, walk the segments from td->start_seg up to it, unmapping every segment that still has a pending bounce. Stopping at td->bounce_seg rather than td->end_seg matters: a bounce implies the TD continues past that segment's link TRB, so bounce_seg is always strictly before end_seg, and a later TD may already have started in end_seg and been bounced there. Walking that far would copy a foreign bounce buffer into this URB and unmap it twice. It also keeps the walk correct if a TD ever wraps the whole ring so that end_seg == start_seg. [mn: Add ring->num_segs check to prevent unlikely infinite for loop.]

Published Sep 16, 2026 · Updated Oct 19, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP, GitHub Security Advisories · CNA: Linux

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.
How the score was calculated
  • EPSS 0.2% (30-day exploitation probability)+2

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation
Not confirmed
Not in CISA KEV — an absence of record, not proof it is unexploited.
EPSS FIRST
0.21%
ahead of 11% of scored CVEs · Oct 19, 2026
Affects
Linux
Linux
CVSS base
—
Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

  1. Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
  2. No fix documented in the sources: reduce exposure and monitor the vendor advisory.
  3. Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

VendorProductVersionsStatusSource
Linux Linux ≥ f9c589e142d04b8a19eb382162f804d17102b5ed and < c8124b28f12dbdd126118e63d0ebf8093a01fb81≥ f9c589e142d04b8a19eb382162f804d17102b5ed and < e04d5304a248e5d2a7f4faa87541644bdd320cfb≥ f9c589e142d04b8a19eb382162f804d17102b5ed and < a1629dfb011446d02905778f6df19f14c5f4f3b3≥ f9c589e142d04b8a19eb382162f804d17102b5ed and < 43239fc6dfb62c50ae1b9c0e82bac0f8cd2e285c≥ f9c589e142d04b8a19eb382162f804d17102b5ed and < 3c9a2b5a4f1183696f02ac280ced1d34afb409b1≥ f9c589e142d04b8a19eb382162f804d17102b5ed and < efaab8938fb92979be6df359f7d1a43fb7e4717d≥ f9c589e142d04b8a19eb382162f804d17102b5ed and < 7236bbd2cb7d9fc0eda896bbd34790341e2a4377≥ f9c589e142d04b8a19eb382162f804d17102b5ed and < ff44dfb03a293bf30e31f98772a1dd316a6071d1
and 1 more version 4.8
Vulnerable CVE Program (cve.org) e CISA ADP

EPSS over time FIRST

Oct 15, 2026 → Oct 19, 2026 · 4 reading(s) · max 0.21%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

  • Not enough vector or weakness data: use the affected application’s logs as a starting point.
application logs

Timeline

What happened to this CVE, newest first.

  • 2026
  • Record published
    Oct 15, 2026
  • Affected products added · linux/linux
    Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
  • Source status changed · → Received
    Oct 15, 2026 · NIST National Vulnerability Database
  • Record created in this database
    Oct 15, 2026 · NIST National Vulnerability Database
  • CVE published
    Sep 16, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

  • 1× References added · Oct 19, 2026 – Oct 19, 2026
  • 1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

10 on the record

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

  • CVE-2026-98866 sched/cache: Introduce task_struct->sched_cache_grp to fix UAF 1d
  • CVE-2026-98867 dm-pcache: bound the logical key offset from persistent memory 1d
  • CVE-2026-98868 dm-pcache: reject a kset that overruns its segment 1d
  • CVE-2026-98856 kprobes: Skip disarmed probes when checking optkprobe overlap 1d
  • CVE-2026-98857 ipvs: bound LBLCR and LBLC cache growth 1d
  • CVE-2026-98858 io_uring: fix task_work add use-after-free with SQPOLL 1d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No CVSS score published by NVD, the CNA, CISA or GitHub so far.
  • No fixed version, patch or mitigation documented.
  • No CISA SSVC assessment.
  • No CWE classification.
  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-90015 is "xhci: fix lost bounce buffers on TDs spanning several ring segments", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.21% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.

Sign in or create an account to comment and suggest corrections.