The ChipIdea UDC driver in the Linux kernel fails to unmap DMA buffers and clean scatter‑gather bounce buffers when an endpoint is shut down. When a device disconnects during a multi‑segment DMA transfer, the request still retains stale DMA state. If that same request object is reused on reconnect, the hardware enqueue path skips DMA mapping and attempts to use freed or invalid DMA addresses, leading to alignment errors and kernel memory corruption. Although the flaw does not immediately grant arbitrary code execution, it can crash the system or corrupt critical kernel memory.

All Linux kernel installations that include the ChipIdea UDC driver are potentially affected until the fix is applied. The vendor information is listed as Linux, and no specific kernel release numbers are provided; therefore, any kernel version prior to the inclusion of the patch in the cited Git commits remains vulnerable.

The CVSS score is not supplied and the EPSS score is unavailable, so a precise numerical severity cannot be given. The vulnerability is not listed in CISA KEV. The likely attack vector is an attacker who can control USB connectivity to the host or inject a malicious USB device, because the fault is triggered by a disconnect/reconnect sequence during an active transfer. The impact is primarily denial of service or memory corruption, and no publicly known exploits have been reported as of the data provided.