Executive brief
The Linux kernel's USB xHCI controller driver can crash when initializing a USB host controller that is inaccessible or has dropped off the bus (e.g., due to power management issues). An unaligned memory read attempt causes the system to crash rather than gracefully handling the failed device, affecting the stability of systems with problematic USB controllers.
Technical details
The vulnerability is a logic error in xhci_gen_setup() where the driver reads a capability register to determine the offset of operational registers. If the controller is inaccessible (returns all-ones, 0xffffffff), the calculated offset becomes unaligned, leading to an unaligned device memory access in xhci_halt(). On ARM64 systems, unaligned accesses to device memory trigger an alignment fault exception and kernel oops. The fix reads the capability register once and checks for the all-ones value before deriving op_regs, aborting setup with -ENODEV if the controller is inaccessible. This error path was already properly implemented in xhci_handshake() and xhci_reset() but was missing from xhci_gen_setup().
Affected products
- Linux Linux kernel multiple versions
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: fix implemented in xhci_gen_setup()