{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-22022","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-29T08:45:45.807Z","datePublished":"2025-04-16T10:23:27.423Z","dateUpdated":"2026-08-05T11:56:04.678Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:56:04.678Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Apply the link chain quirk on NEC isoc endpoints\n\nTwo clearly different specimens of NEC uPD720200 (one with start/stop\nbug, one without) were seen to cause IOMMU faults after some Missed\nService Errors. Faulting address is immediately after a transfer ring\nsegment and patched dynamic debug messages revealed that the MSE was\nreceived when waiting for a TD near the end of that segment:\n\n[ 1.041954] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ffa08fe0\n[ 1.042120] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09000 flags=0x0000]\n[ 1.042146] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09040 flags=0x0000]\n\nIt gets even funnier if the next page is a ring segment accessible to\nthe HC. Below, it reports MSE in segment at ff1e8000, plows through a\nzero-filled page at ff1e9000 and starts reporting events for TRBs in\npage at ff1ea000 every microframe, instead of jumping to seg ff1e6000.\n\n[ 7.041671] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\n[ 7.041999] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\n[ 7.042011] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042028] xhci_hcd: All TDs skipped for slot 1 ep 2. Clear skip flag.\n[ 7.042134] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042138] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\n[ 7.042144] xhci_hcd: Looking for event-dma 00000000ff1ea040 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.042259] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042262] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\n[ 7.042266] xhci_hcd: Looking for event-dma 00000000ff1ea050 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n\nAt some point completion events change from Isoch Buffer Overrun to\nShort Packet and the HC finally finds cycle bit mismatch in ff1ec000.\n\n[ 7.098130] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\n[ 7.098132] xhci_hcd: Looking for event-dma 00000000ff1ecc50 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.098254] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\n[ 7.098256] xhci_hcd: Looking for event-dma 00000000ff1ecc60 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.098379] xhci_hcd: Overrun event on slot 1 ep 2\n\nIt's possible that data from the isochronous device were written to\nrandom buffers of pending TDs on other endpoints (either IN or OUT),\nother devices or even other HCs in the same IOMMU domain.\n\nLastly, an error from a different USB device on another HC. Was it\ncaused by the above? I don't know, but it may have been. The disk\nwas working without any other issues and generated PCIe traffic to\nstarve the NEC of upstream BW and trigger those MSEs. The two HCs\nshared one x1 slot by means of a commercial \"PCIe splitter\" board.\n\n[ 7.162604] usb 10-2: reset SuperSpeed USB device number 3 using xhci_hcd\n[ 7.178990] sd 9:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s\n[ 7.179001] sd 9:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 04 02 ae 00 00 02 00 00\n[ 7.179004] I/O error, dev sdb, sector 67284480 op 0x0:(READ) flags 0x80700 phys_seg 5 prio class 0\n\nFortunately, it appears that this ridiculous bug is avoided by setting\nthe chain bit of Link TRBs on isochronous rings. Other ancient HCs are\nknown which also expect the bit to be set and they ignore Link TRBs if\nit's not. Reportedly, 0.95 spec guaranteed that the bit is set.\n\nThe bandwidth-starved NEC HC running a 32KB/uframe UVC endpoint reports\ntens of MSEs per second and runs into the bug within seconds. Chaining\nLink TRBs allows the same workload to run for many minutes, many times.\n\nNo ne\n---truncated---"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - No network or adjacent path exists; the flaw is driven by a local unprivileged user starting a high-bandwidth isochronous stream on an already-attached UVC/USB-audio device on a NEC xHCI and concurrently starving the controller's upstream PCIe bandwidth. Physical plug-in is an alternative route but local access alone is sufficient.\nAC:L - The attacker controls both required conditions — the isochronous load (highest alt setting, ~32 KB/uframe) and the competing PCIe traffic that induces Missed Service Errors — and the commit reports tens of MSEs per second hitting the bug \"within seconds\", reproduced on two distinct uPD720200 specimens.\nPR:L - Only a normal local session is needed; the video/ALSA device nodes are granted to the logged-in user by the standard systemd-logind uaccess ACLs, and no root, CAP_SYS_ADMIN, or CAP_SYS_RAWIO is involved anywhere on the path.\nUI:N - The attacker initiates the isochronous stream and the competing I/O themselves; no victim action, mount, or file open by another user is required.\nS:U - The corrupted resources are kernel DMA buffers managed by the same kernel security authority, and the IOMMU is not bypassed — it actually faults on out-of-domain accesses, confining the damage to the kernel itself.\nC:H - The controller fetches garbage adjacent memory as TRBs and honors their buffer pointers, so on isochronous OUT endpoints it DMA-reads arbitrary in-domain kernel memory and transmits it to the attacker's USB device, and on IOMMU-less systems the read reaches all of RAM.\nI:H - Attacker-supplied isochronous device data is DMA-written into unrelated kernel buffers belonging to other endpoints, other devices, and even other host controllers, giving an attacker-influenced kernel write primitive; real corruption was observed as block I/O errors on an unrelated disk.\nA:H - Observed effects include IOMMU page-fault storms, wedged endpoints replaying bogus events every microframe, USB device resets, and storage I/O failures, and overwriting adjacent transfer-ring segments or arbitrary kernel structures readily produces an oops or panic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/host/xhci.h"],"versions":[{"version":"7e393a834b41001174a8fb3ae3bc23a749467760","lessThan":"abf2df229b6a9172cc1827749c1a446d28e00a2e","status":"affected","versionType":"git"},{"version":"7e393a834b41001174a8fb3ae3bc23a749467760","lessThan":"8b586de6f03c850ff48d42e539b4708d1f3f8f1a","status":"affected","versionType":"git"},{"version":"7e393a834b41001174a8fb3ae3bc23a749467760","lessThan":"1143f790a6316201dc8f067eba4c94ea97ecb6ca","status":"affected","versionType":"git"},{"version":"7e393a834b41001174a8fb3ae3bc23a749467760","lessThan":"dbf427663ce272070d3004b5fca63a4a537d781c","status":"affected","versionType":"git"},{"version":"7e393a834b41001174a8fb3ae3bc23a749467760","lessThan":"a4931d9fb99eb5462f3eaa231999d279c40afb21","status":"affected","versionType":"git"},{"version":"7e393a834b41001174a8fb3ae3bc23a749467760","lessThan":"43a18225150ce874d23b37761c302a5dffee1595","status":"affected","versionType":"git"},{"version":"7e393a834b41001174a8fb3ae3bc23a749467760","lessThan":"061a1683bae6ef56ab8fa392725ba7495515cd1d","status":"affected","versionType":"git"},{"version":"7e393a834b41001174a8fb3ae3bc23a749467760","lessThan":"bb0ba4cb1065e87f9cc75db1fa454e56d0894d01","status":"affected","versionType":"git"},{"version":"5c7a6982e976b381595c9d4ee8e8c94564a40aec","status":"affected","versionType":"git"},{"version":"f12ea4a8ca7009fa2d54794c3fcb8e638453bcff","status":"affected","versionType":"git"},{"version":"3.0.9","lessThan":"3.1","status":"affected","versionType":"semver"},{"version":"3.1.1","lessThan":"3.2","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/host/xhci.h"],"versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","status":"unaffected","versionType":"semver"},{"version":"5.10.248","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.198","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.160","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.120","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.22","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.10","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14.1","lessThanOrEqual":"6.14.*","status":"unaffected","versionType":"semver"},{"version":"6.15","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"5.10.248"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"5.15.198"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.1.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.6.120"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.12.22"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.13.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.14.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/abf2df229b6a9172cc1827749c1a446d28e00a2e"},{"url":"https://git.kernel.org/stable/c/8b586de6f03c850ff48d42e539b4708d1f3f8f1a"},{"url":"https://git.kernel.org/stable/c/1143f790a6316201dc8f067eba4c94ea97ecb6ca"},{"url":"https://git.kernel.org/stable/c/dbf427663ce272070d3004b5fca63a4a537d781c"},{"url":"https://git.kernel.org/stable/c/a4931d9fb99eb5462f3eaa231999d279c40afb21"},{"url":"https://git.kernel.org/stable/c/43a18225150ce874d23b37761c302a5dffee1595"},{"url":"https://git.kernel.org/stable/c/061a1683bae6ef56ab8fa392725ba7495515cd1d"},{"url":"https://git.kernel.org/stable/c/bb0ba4cb1065e87f9cc75db1fa454e56d0894d01"}],"title":"usb: xhci: Apply the link chain quirk on NEC isoc endpoints","x_generator":{"engine":"bippy-1.2.0"}}}}