Executive brief
A vulnerability was identified in the Linux kernel's USB driver (xHCI) that could cause a system crash (kernel panic) when a USB device with active data streams is disconnected. The issue occurs because the system incorrectly attempts to perform a memory cleanup task that requires 'sleeping' while it is in a restricted 'atomic' state where sleeping is forbidden. This results in a system bug check, potentially leading to a denial of service for the affected machine.
Technical details
The vulnerability is a 'sleep in atomic context' bug within the xhci_free_streams() function in drivers/usb/host/xhci.c. When a USB device with active stream endpoints is disconnected, the hub_event workqueue calls xhci_free_streams(), which invokes xhci_free_stream_info() while holding the xhci->lock with interrupts disabled. This function eventually calls dma_free_coherent(), which may sleep (e.g., via vunmap). Calling a sleeping function while holding a spinlock triggers a kernel BUG. The fix involves refactoring the code to clear endpoint references under the lock but deferring the actual memory deallocation until after the lock is released.
Affected products
- Linux Linux Kernel 8df75f42f8e6 to 42c37c4b75d3
Timeline
- 2026-07-03: disclosed: Patch submitted by Lianqin Hu
- 2026-07-24: patched: Committed to stable tree by Greg Kroah-Hartman
- 2026-07-25: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/10666ac9c552990204e791af653abf8e9d9ff619
- https://git.kernel.org/stable/c/1e45aa722c4ce5663e987102aac18c8ad6a83fdd
- https://git.kernel.org/stable/c/42c37c4b75d38b51d84f31a8e29427f5e06a7c2a
- https://git.kernel.org/stable/c/93cd037da94fcb93183bfb2457e3a56d3eb4c8f4
- https://git.kernel.org/stable/c/d107eb316144c5fb958486e7fe604cd7f1b35cda
- https://git.kernel.org/stable/c/e623e4a203f56d5c57519a9a3cb29600551534ad
- https://git.kernel.org/stable/c/f7b022ae07685e7526fc39f387ce65b5d309dd3b