Junglewise Threat Intelligence

CVE-2026-43431: Linux kernel NULL pointer dereference in xHCI debugfs

CVE-2026-43431 · Severity: medium · CVSS 5.5 · Published 2026-05-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB driver could allow a local user to crash the system. The issue occurs when a user attempts to read specific diagnostic files related to USB port information. This could lead to a denial-of-service, impacting system availability and ongoing operations.

Technical details

A NULL pointer dereference exists in the xHCI driver within the xhci_portli_show function in drivers/usb/host/xhci-debugfs.c. The vulnerability is triggered when there are more port registers counted in xhci->max_ports than ports reported by Supported Protocol capabilities, or when gaps exist between ports of different speeds. In these scenarios, port->rhub is NULL, and attempting to dereference it to reach the xhci structure causes a kernel oops. An attacker with local access to debugfs can trigger this crash by reading the affected portli debugfs files. The fix introduces an explicit NULL check for port->rhub before dereferencing.

Affected products

  • Linux Linux kernel All versions including xHCI debugfs PORTLI support

Timeline

  • 2026-03-05: patched: Initial patch authored by Mathias Nyman
  • 2026-05-08: disclosed: CVE published

References

Related threats