CVE-2026-93118: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed_udc: check endpoint DMA allocat
Summary
A bug in the Linux kernel's Aspeed USB Device Controller driver could crash during startup if memory allocation failed. The problem was that the code tried to use a memory buffer without checking if the allocation succeeded first, and the error handling cleanup process could cause additional problems. This was discovered through automated code analysis.
Solution / Mitigation
Check the DMA (direct memory access, a method for hardware to access memory without the CPU) allocation before setting up endpoints. Replace the existing probe error path that called ast_udc_remove() with a local cleanup helper that only unwinds resources that were actually initialized, preventing unsafe operations before usb_add_gadget_udc() succeeds.
Vulnerability Details
EPSS: 0.0%
September 17, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-93118
First tracked: September 17, 2026 at 02:07 PM
Classified by LLM (prompt v3) · confidence: 95%