Race Condition in Linux Kernel USB Core Affecting Device Stability

CVE-2026-80830

What is CVE-2026-80830?

A race condition exists in the Linux Kernel's USB core, specifically in the usb_wakeup_notification() function. This vulnerability stems from the lack of proper locking mechanisms during its execution. The xHCI driver, which can invoke this function from an interrupt context, may conflict with the hub_disconnect() function that adequately enforces a lock to maintain the device's state. This situation can lead to dereferencing freed memory, potentially compromising system stability and integrity. The recent fix introduces a spin lock to mitigate this issue, ensuring safe operation and preventing crashes related to USB device handling.

References