Linux Kernel Vulnerability in USB Host Controller

CVE-2026-80861

What is CVE-2026-80861?

A vulnerability in the Linux kernel affects USB host controllers, particularly in scenarios where the controller becomes inaccessible. The issue is rooted in the xhci_gen_setup() function when it retrieves operational registers using the capability length. If the controller fails or disconnects, it returns an invalid value, leading to unaligned memory access. This situation can trigger a kernel fault and internal errors, especially on arm64 architectures, during the device setup process. The fix involves an additional check to abort setup safely if an invalid state is detected, preventing further complications such as incorrect register reads during device hot-removal.

References