Executive brief
A vulnerability in the Linux kernel's USB driver could allow a local user to crash the system. The issue occurs when a user attempts to read specific diagnostic files related to USB port information. This could lead to a denial-of-service, impacting system availability and ongoing operations.
Technical details
A NULL pointer dereference exists in the xHCI driver within the xhci_portli_show function in drivers/usb/host/xhci-debugfs.c. The vulnerability is triggered when there are more port registers counted in xhci->max_ports than ports reported by Supported Protocol capabilities, or when gaps exist between ports of different speeds. In these scenarios, port->rhub is NULL, and attempting to dereference it to reach the xhci structure causes a kernel oops. An attacker with local access to debugfs can trigger this crash by reading the affected portli debugfs files. The fix introduces an explicit NULL check for port->rhub before dereferencing.
Affected products
- Linux Linux kernel All versions including xHCI debugfs PORTLI support
Timeline
- 2026-03-05: patched: Initial patch authored by Mathias Nyman
- 2026-05-08: disclosed: CVE published