CVE-2026-43488: usb: xhci: Prevent interrupt storm on host controller error (HCE)
In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: Prevent interrupt storm on host controller error (HCE)
The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhciirq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults.
When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhcihalt().
Add xhcihalt() to xhciirq() function where STSHCE status is checked, mirroring the existing error handling pattern used for STSFATAL errors.
This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43488?
The severity of CVE-2026-43488 is classified as moderate due to its potential to cause system instability.
How do I fix CVE-2026-43488?
To fix CVE-2026-43488, update your Linux kernel to the latest version where the vulnerability has been patched.
Which systems are affected by CVE-2026-43488?
CVE-2026-43488 affects Linux systems that use the xHCI USB controller.
What is the impact of CVE-2026-43488 on performance?
CVE-2026-43488 can lead to an interrupt storm that may degrade system performance during USB device plug/unplug operations.
Is there a workaround for CVE-2026-43488?
Currently, the best workaround for CVE-2026-43488 is to apply the recommended kernel updates that resolve the issue.