xhci: fix lost bounce buffers on TDs spanning several ring segments

{
  "id": "4164bd023e3b327660b9b2631c7b80910306e82132f1fefee0c46fa996858e74",
  "url": "https://osv.dev/vulnerability/CVE-2026-90015",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "xhci: fix lost bounce buffers on TDs spanning several ring segments",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, xhci_align_td() stages the unalignable tail through the bounce buffer of the ring segment holding that link TRB. xhci_unmap_td_bounce_buffer() later unmaps it and, for IN transfers, copies the data back into the URB's buffer. The enqueue path records the segment that was bounced in td->bounce_seg, under the assumption that a TD never spans more than two ring segments. That assumption does not hold: a TD large enough to span three or more segments crosses several link TRBs and can be bounced at each of them. Only the last one survives in td->bounce_seg, so every earlier bounce buffer is neither copied back nor DMA unmapped. The URB still completes with actual_length equal to the requested length and no error, so the transfer looks successful while a wMaxPacketSize sized hole in the destination buffer silently keeps its previous contents. It also leaks a DMA mapping per dropped bounce. Any sufficiently large and fragmented bulk transfer can hit this. It was found with a USB mass storage device behind xHCI backing a dm-verity target with 512 byte hash blocks, where the stale data is detected rather than silently consumed. The device enumerates as SuperSpeed, so wMaxPacketSize is 1024, while dm-bufio issues one 512 byte bio per hash block. verity_prefetch",
    "evidence": "osv:CVE-2026-90015",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.270",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.221",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.188",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.157",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.110",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.51",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.2.5",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-90015",
      "aliases": [
        "CVE-2026-90015"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "f9c589e142d04b8a19eb382162f804d17102b5ed"
                },
                {
                  "fixed": "c8124b28f12dbdd126118e63d0ebf8093a01fb81"
                },
                {
                  "fixed": "e04d5304a248e5d2a7f4faa87541644bdd320cfb"
                },
                {
                  "fixed": "a1629dfb011446d02905778f6df19f14c5f4f3b3"
                },
                {
                  "fixed": "43239fc6dfb62c50ae1b9c0e82bac0f8cd2e285c"
                },
                {
                  "fixed": "3c9a2b5a4f1183696f02ac280ced1d34afb409b1"
                },
                {
                  "fixed": "efaab8938fb92979be6df359f7d1a43fb7e4717d"
                },
                {
                  "fixed": "7236bbd2cb7d9fc0eda896bbd34790341e2a4377"
                },
                {
                  "fixed": "ff44dfb03a293bf30e31f98772a1dd316a6071d1"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90015.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.8.0"
                },
                {
                  "fixed": "5.10.270"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.221"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.188"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.157"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.110"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.51"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.2.5"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90015.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:48.990244862Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/3c9a2b5a4f1183696f02ac280ced1d34afb409b1",
        "https://git.kernel.org/stable/c/43239fc6dfb62c50ae1b9c0e82bac0f8cd2e285c",
        "https://git.kernel.org/stable/c/7236bbd2cb7d9fc0eda896bbd34790341e2a4377",
        "https://git.kernel.org/stable/c/a1629dfb011446d02905778f6df19f14c5f4f3b3",
        "https://git.kernel.org/stable/c/c8124b28f12dbdd126118e63d0ebf8093a01fb81",
        "https://git.kernel.org/stable/c/e04d5304a248e5d2a7f4faa87541644bdd320cfb",
        "https://git.kernel.org/stable/c/efaab8938fb92979be6df359f7d1a43fb7e4717d",
        "https://git.kernel.org/stable/c/ff44dfb03a293bf30e31f98772a1dd316a6071d1",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90015.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-90015",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90015.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-90015",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 517548,
  "published_at": "2026-09-16T10:33:21.471+00:00"
}