The Linux kernel's usb: mtu3 driver had a vulnerability where the function mtu3_gadget_queue() mapped DMA requests before verifying if the QMU GPD ring could accept another transfer. If mtu3_prepare_transfer() failed, the request was returned with an error (-EAGAIN) without being linked to the endpoint request list, and crucially, the DMA mapping was not unmapped due to the error path not invoking the unmapping helper mtu3_req_complete(). This left DMA mappings active unintentionally, which was corrected by adding unmapping of the request before returning from the failure path.

The vulnerability results in DMA mappings remaining active after a queue failure, potentially causing resource leakage or instability in the USB gadget driver subsystem. There is no indication of direct code execution or privilege escalation from the provided data. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to unmap DMA requests on queue failure in the mtu3 driver. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.