CVE-2026-43431 Overview
CVE-2026-43431 is a NULL pointer dereference vulnerability in the Linux kernel's xHCI (eXtensible Host Controller Interface) USB driver. The flaw resides in the portli debugfs file handling, where reading the file triggers an oops when xhci->max_ports exceeds the number of ports reported by the Supported Protocol capabilities. In such configurations, port->rhub remains NULL, and dereferencing it crashes the kernel. The issue surfaces when port number gaps exist between USB ports of different speeds in the controller's Supported Protocol capabilities.
Critical Impact
Local users with access to xhci debugfs files can trigger a kernel NULL pointer dereference, causing denial of service on affected Linux systems.
Affected Products
- Linux kernel versions containing the recently added xhci portli debugfs files
- Systems with xHCI USB host controllers where max_ports exceeds Supported Protocol capability port counts
- Linux distributions shipping unpatched mainline and stable kernel branches
Discovery Timeline
- 2026-05-08 - CVE-2026-43431 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43431
Vulnerability Analysis
The vulnerability exists in the xHCI driver's debugfs interface, specifically in the read handler for the newly introduced portli debugfs files. The xHCI driver tracks port count using xhci->max_ports, which is derived from the host controller's port register count. Each port is expected to be associated with a roothub structure through port->rhub. When a user reads a portli debugfs file, the handler dereferences port->rhub to access xHCI state behind the roothub pointer. If port->rhub is NULL, the kernel performs an invalid memory access and generates an oops [CWE-476].
Root Cause
The root cause is a mismatch between xhci->max_ports and the actual ports enumerated through the Supported Protocol capabilities. Two scenarios produce this state. First, max_ports may exceed the highest port number described by any Supported Protocol capability. Second, gaps may exist between ports of different speeds within those capabilities. In both cases, certain port entries are allocated but never linked to a roothub, leaving port->rhub as NULL. The original portli debugfs handler assumed every port had a valid roothub association.
Attack Vector
A local user with read permissions on the xhci debugfs file hierarchy can trigger the dereference by reading the portli files. Debugfs is typically mounted at /sys/kernel/debug and restricted to root, limiting the practical attack surface to local privileged users or processes. The result is a kernel oops and potential system instability rather than memory disclosure or code execution.
No public exploit code or proof-of-concept has been released for this issue. Technical details are available in the upstream commits 9c8bef223c6e and ae4ff9dead5e.
Detection Methods for CVE-2026-43431
Indicators of Compromise
- Kernel oops messages referencing xhci_hcd, portli, or NULL pointer dereferences in xhci debugfs read paths
- Unexpected USB subsystem failures or host controller resets following debugfs access
- dmesg entries showing call traces originating from xhci debugfs file operations
Detection Strategies
- Monitor /var/log/kern.log and journald for kernel oops signatures involving xhci modules
- Audit processes accessing /sys/kernel/debug/usb/xhci/*/portli paths on production hosts
- Track kernel version inventory to identify hosts running unpatched builds that include the portli debugfs feature
Monitoring Recommendations
- Enable kernel crash reporting (kdump, systemd-coredump) to capture oops events for analysis
- Forward kernel logs to a centralized SIEM for correlation across the fleet
- Alert on repeated xhci-related kernel warnings, which may indicate triggering of the NULL dereference
How to Mitigate CVE-2026-43431
Immediate Actions Required
- Apply the upstream fix from kernel commits 9c8bef223c6e991276188d30d74bdb2cbd8be652 and ae4ff9dead5efa2025eddfcdb29411432bf40a7c
- Restrict access to /sys/kernel/debug so only root can read xhci debugfs files
- Update to the latest stable Linux kernel release from your distribution that includes the fix
Patch Information
The fix adds an explicit NULL check before dereferencing port->rhub in the portli debugfs read handler. When port->rhub is NULL, the handler prints the portli value in hexadecimal without accessing the missing roothub structure. Patches are available in the stable kernel commit 9c8bef22 and the stable kernel commit ae4ff9de.
Workarounds
- Unmount debugfs on systems where it is not required: umount /sys/kernel/debug
- Set restrictive permissions on debugfs mount: mount -o remount,mode=700 /sys/kernel/debug
- Avoid reading portli files on affected kernels until patches are deployed
# Configuration example - restrict debugfs access
mount -o remount,mode=700,uid=0,gid=0 /sys/kernel/debug
# Verify kernel version includes the fix
uname -r
dmesg | grep -i xhci
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
