Executive brief
The Linux kernel's USB core subsystem contains a race condition in the usb_wakeup_notification() function that can allow multiple concurrent accesses to free memory. This vulnerability could be triggered by xHCI USB controllers when processing interrupts, leading to system crashes or potential memory corruption that could affect system stability and reliability.
Technical details
The vulnerability is a use-after-free race condition in drivers/usb/core/hub.c within the usb_wakeup_notification() function. The root cause is missing synchronization (spin lock) when dereferencing USB hub data structures. The xHCI driver can call this function from interrupt context (IRQ), while the hub_disconnect() function may simultaneously modify the same data, creating a race window. The fix adds spin_lock_irqsave/spin_unlock_irqrestore calls around the device_state_lock to serialize access. The vulnerability affects systems with connected USB devices, particularly those using xHCI controllers. Patches are available in the Linux kernel stable tree as of September 2026.
Affected products
- Linux Linux kernel all versions prior to fix commit e263e18a9e7b1ff3e7301f0801c6ff87c31adfb6
Timeline
- 2026-09-04: disclosed: CVE-2026-80830 published
- 2026-09-02: patched: Fix committed to stable kernel tree