usb: xhci: bail out of setup if the controller is inaccessible
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhci_gen_setup() locates the operational registers using the capability length read from the very first register: xhci->op_regs = hcd->regs + HC_LENGTH(readl(&xhci->cap_regs->hc_capbase)); If the controller is dead or has dropped off the bus, that read returns ~0, HC_LENGTH() truncates it to 0xff, and op_regs ends up 0xff bytes past the page-aligned MMIO base, i.e. unaligned. The first access through it, xhci_halt() -> xhci_handshake() reading op_regs->status, is then an unaligned readl() on device memory. arm64 faults on unaligned device accesses, so instead of xhci_handshake() catching the all-ones value and returning -ENODEV, setup oopses: xhci-pci-renesas 0005:08:00.0: Unable to change power state from D3cold to D0, device inaccessible xhci-pci-renesas 0005:08:00.0: xHCI Host Controller xhci-pci-renesas 0005:08:00.0: new USB bus registered, assigned bus number 1 Unable to handle kernel paging request at virtual address ffff80030a770103 ESR = 0x0000000096000021 FSC = 0x21: alignment fault Internal error: Oops: 0000000096000021 [#1] SMP pc : xhci_halt [xhci_hcd] Call trace: xhci_halt xhci_gen_setup xhci_pci_setup usb_add_hcd usb_hcd_pci_probe xhci_pci_common_probe xhci_pci_renesas_probe This was hit with a Renesas uPD720201 that failed to power up ("Unable to change power state from D3cold to D0, device inaccessible") yet still reached the HCD p
CVE-2026-80861
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-80861
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "66d4eadd8d067269ea8fead1a50fe87c2979a80d",
"lessThan": "301f4a3303b21ea959a8294518ee883710498ac2",
"versionType": "git"
},
{
"status": "affected",
"version": "66d4eadd8d067269ea8fead1a50fe87c2979a80d",
"lessThan": "70706dbcf122940f4e3595d7ba1445004cc00074",
"versionType": "git"
},
{
"status": "affected",
"version": "66d4eadd8d067269ea8fead1a50fe87c2979a80d",
"lessThan": "c051f66b621695ad7c8438a9497d79e1f4f05edb",
"versionType": "git"
},
{
"status": "affected",
"version": "66d4eadd8d067269ea8fead1a50fe87c2979a80d",
"lessThan": "bf84c6b0264947794fa783c324a6d874ca6657d8",
"versionType": "git"
},
{
"status": "affected",
"version": "66d4eadd8d067269ea8fead1a50fe87c2979a80d",
"lessThan": "0b31744f70c5e06cce5fb660e02d057a3b9e0e37",
"versionType": "git"
},
{
"status": "affected",
"version": "66d4eadd8d067269ea8fead1a50fe87c2979a80d",
"lessThan": "78203d5b54a40f0e36196ebf31c9c7a380fc8811",
"versionType": "git"
}
],
"programFiles": [
"drivers/usb/host/xhci.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.31",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/usb/host/xhci.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-80861
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #34876 · Revision 1
- Added to Heist Feed
- Publisher date