usb: xhci: Fix invalid pointer dereference in Etron workaround

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix invalid pointer dereference in Etron workaround This check is performed before prepare_transfer() and prepare_ring(), so enqueue can already point at the final link TRB of a segment. And indeed it will, some 0.4% of times this code is called. Then enqueue + 1 is an invalid pointer. It will crash the kernel right away or load some junk which may look like a link TRB and cause the real link TRB to be replaced with a NOOP. This wouldn't end well. Use a functionally equivalent test which doesn't dereference the pointer and always gives correct result. Something has crashed my machine twice in recent days while playing with an Etron HC, and a control transfer stress test ran for confirmation has just crashed it again. The same test passes with this patch applied.

Timeline

1. May 8, 2025, 6:26 AM UTCCVE published
2. Oct 15, 2026, 9:45 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 15, 2026, 9:52 PM UTCRecord last updated

Affected versions

• Linux Linux

  From fbc0a0c7718a6cb1dc5e0811a4f88a2b1deedfa1 · fixed in 142273a49f2c315eabdbdf5a71c15e479b75ca91; From 9258c9ed32294ce3a4b58c9d92fc49ba030d35c9 · fixed in bce3055b08e303e28a8751f6073066f5c33a0744; From 5e1c67abc9301d05130b7e267c204e7005503b33 · fixed in 0624e29c595b05e7a0e6d1c368f0a05799928e30; From 5e1c67abc9301d05130b7e267c204e7005503b33 · fixed in 1ea050da5562af9b930d17cbbe9632d30f5df43a; From 6.6.66 · fixed in 6.6.89; From 6.12.2 · fixed in 6.12.26; From 6.11.11 · fixed in 6.12

• Linux Linux

  6.13

• KernelLinux

  fixed in 6.6.89; From 6.7.0 · fixed in 6.12.26; From 6.13.0 · fixed in 6.14.5

References 4