CVE-2026-43488

Vulnerability

Overview

In the Linux kernel's USB xHCI driver, a Host Controller Error (HCE) can be triggered during UAS Storage Device plug/unplug scenarios on Android devices. When the HCE status is detected in the xhci_irq() interrupt handler, the driver previously only logged a warning and assumed the controller would stop activity as per the xHCI specification. However, on some hosts, the interrupt continues to fire after HCE, causing an interrupt storm that leads to severe system-level faults.

Exploitation and

Attack Surface

The vulnerability is triggered by physical USB events (plugging or unplugging a UAS storage device) that cause the xHC to report HCE. No authentication or special privileges are required beyond physical access to a USB port. The interrupt storm occurs because the driver does not disable the xHC interrupt or halt the controller when HCE is detected, unlike the existing error handling for STS_FATAL errors.

Impact

An attacker with physical USB access can cause a denial-of-service (DoS) condition by repeatedly plugging/unplugging a UAS device, triggering HCE and the subsequent interrupt storm. This can render the system unresponsive or cause severe performance degradation.

Mitigation

The fix adds a call to xhci_halt() in the xhci_irq() function where STS_HCE is checked, mirroring the pattern used for STS_FATAL errors. This stops the interrupt storm by disabling the xHC interrupt and halting the controller. Proper HCE recovery still requires a full reset and re-initialization of the xHC. The patch has been applied to the stable kernel trees [1][2][3][4].