Junglewise Threat Intelligence

CVE-2026-43488: Linux Kernel interrupt storm in xHCI USB driver

CVE-2026-43488 · Severity: info · Published 2026-05-13

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB driver can cause a system to become unresponsive or crash when certain USB storage devices are plugged in or unplugged. This occurs because the system enters a loop of continuous error signals (an 'interrupt storm') that it cannot clear. This issue primarily affects Android devices and other systems using the xHCI USB controller, potentially leading to a complete denial of service.

Technical details

The xHCI driver in the Linux kernel fails to properly handle Host Controller Error (HCE) states in the xhci_irq() function. When a UAS Storage Device is plugged or unplugged, the controller may report an HCE; however, because the driver only logs a warning without clearing the interrupt or halting the controller, the system enters an interrupt storm. This leads to severe system-level faults and denial of service. The fix involves explicitly calling xhci_halt() when the STS_HCE status is detected to stop controller activity and cease the interrupt storm. Proper recovery still requires a subsequent reset and re-initialization of the xHC.

Affected products

  • Linux Linux Kernel All versions prior to the fix (specifically observed on Android devices)

Timeline

  • 2026-03-19: patched: Fix committed to Linux stable tree
  • 2026-05-13: disclosed: CVE published

References

Related threats