Executive brief
A vulnerability in the Linux kernel's USB driver can cause a system to become unresponsive or crash when certain USB storage devices are plugged in or unplugged. This occurs because the system enters a loop of continuous error signals (an 'interrupt storm') that it cannot clear. This issue primarily affects Android devices and other systems using the xHCI USB controller, potentially leading to a complete denial of service.
Technical details
The xHCI driver in the Linux kernel fails to properly handle Host Controller Error (HCE) states in the xhci_irq() function. When a UAS Storage Device is plugged or unplugged, the controller may report an HCE; however, because the driver only logs a warning without clearing the interrupt or halting the controller, the system enters an interrupt storm. This leads to severe system-level faults and denial of service. The fix involves explicitly calling xhci_halt() when the STS_HCE status is detected to stop controller activity and cease the interrupt storm. Proper recovery still requires a subsequent reset and re-initialization of the xHC.
Affected products
- Linux Linux Kernel All versions prior to the fix (specifically observed on Android devices)
Timeline
- 2026-03-19: patched: Fix committed to Linux stable tree
- 2026-05-13: disclosed: CVE published
References
- https://git.kernel.org/stable/c/09ff0099c6cf148ff1f7053b5b6c84beb1c2ef8d
- https://git.kernel.org/stable/c/6f91f3f087194c114d6d8ea4591b850bb00672f8
- https://git.kernel.org/stable/c/b2dd9abf8c06cfcbcf242321fd54ae51a4807705
- https://git.kernel.org/stable/c/cd41e0d1df8fcf5eae294657da52b50d1ce03246
- https://git.kernel.org/stable/c/d6d5febd12452b7fd951fdd15c3ec262f01901a4