The ChipIdea UDC driver in the Linux kernel fails to unmap DMA buffers and clean scatter‑gather bounce buffers when an endpoint is shut down. When a device disconnects during a multi‑segment DMA transfer, the request still retains stale DMA state. If that same request object is reused on reconnect, the hardware enqueue path skips DMA mapping and attempts to use freed or invalid DMA addresses, leading to alignment errors and kernel memory corruption. Although the flaw does not immediately grant arbitrary code execution, it can crash the system or corrupt critical kernel memory.

All Linux kernel installations that include the ChipIdea UDC driver are potentially affected until the fix is applied. The vendor information is listed as Linux, and no specific kernel release numbers are provided; therefore, any kernel version prior to the inclusion of the patch in the cited Git commits remains vulnerable.

The CVSS score of 7.8 indicates moderate to high severity, while the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not included in CISA’s KEV catalog. The likely attack vector involves an attacker controlling USB connectivity, such as a malicious USB device or orchestrating a disconnect/reconnect cycle during active transfers. The impact is primarily denial of service or memory corruption, consistent with the identified CWEs of improper memory management and improper handle disposal. No publicly known exploits have been reported as of the data provided.