CVE-2026-43432 Overview
CVE-2026-43432 is a memory leak vulnerability in the Linux kernel's USB xHCI (eXtensible Host Controller Interface) driver. The flaw exists in the xhci_disable_slot() function within the USB host controller subsystem. When the error handling path executes, the code calls kfree() directly on a command structure allocated by xhci_alloc_command(). This leaks the associated completion structure that was allocated alongside the command structure.
The issue was discovered using an experimental LLVM-based static analysis tool focused on memory management defects. It was originally detected on Linux kernel v6.13-rc1 and confirmed in the latest mainline kernel at the time of disclosure.
Critical Impact
Repeated triggering of the error path in xhci_disable_slot() causes kernel memory to leak, gradually exhausting kernel heap resources and potentially leading to denial of service on long-running systems.
Affected Products
- Linux kernel (mainline) versions including v6.13-rc1 and later prior to fix
- Linux stable kernel branches receiving xHCI driver backports
- Distributions shipping the affected drivers/usb/host/xhci.c code
Discovery Timeline
- 2026-05-08 - CVE-2026-43432 published to the National Vulnerability Database
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43432
Vulnerability Analysis
The Linux xHCI driver manages USB 3.x host controllers and is responsible for enabling and disabling device slots. The helper xhci_alloc_command() accepts a boolean parameter that determines whether a struct completion should be allocated alongside the command structure. When this parameter is true, both objects are heap-allocated and linked through the command's completion field.
In xhci_disable_slot(), the error handling branch frees only the command structure using kfree(). The companion completion object is never freed, producing a kernel memory leak on every error-path execution. Because xhci_disable_slot() is invoked during device teardown and USB enumeration failures, repeated USB device hot-plug cycles or abnormal controller states can accumulate leaked kernel memory.
The fix replaces the direct kfree() call with xhci_free_command(), which correctly releases both the command structure and its completion. The patch is safe because the command is zero-initialized, leaving command->in_ctx as NULL, so xhci_free_command() will not attempt to free unallocated context memory.
Root Cause
The root cause is improper resource cleanup [Memory Leak] in the error path of xhci_disable_slot(). The original code does not account for the auxiliary completion structure attached to the command object, releasing only one of two allocated resources.
Attack Vector
Triggering the leak requires hardware conditions or abnormal controller states that cause xhci_disable_slot() to take its error path. A local attacker capable of repeatedly attaching, detaching, or fuzzing USB devices may amplify the leak. The vulnerability does not provide code execution or privilege escalation, but sustained exploitation can degrade kernel memory availability.
No verified proof-of-concept code is available. See the upstream commits referenced below for the precise code paths involved, including Linux Kernel Commit 078b446e and Linux Kernel Commit c65f1b84.
Detection Methods for CVE-2026-43432
Indicators of Compromise
- Gradual growth in kernel slab allocations associated with completion objects without a corresponding increase in active USB devices
- Increasing kmalloc-* slab usage visible in /proc/slabinfo correlated with USB device enumeration failures
- Kernel log entries from the xHCI driver indicating repeated xhci_disable_slot() failures or slot disable errors
Detection Strategies
- Monitor kernel memory growth over time on systems with frequent USB hot-plug activity, comparing baseline to current MemAvailable and slab consumption
- Audit running kernel versions across the fleet to identify hosts running unpatched xHCI driver code
- Use kernel memory leak detection facilities such as kmemleak on test systems to confirm presence of the issue prior to patching
Monitoring Recommendations
- Track Linux kernel versions and patch levels via configuration management tooling and flag hosts missing the upstream stable backports
- Alert on anomalous slab cache growth tied to xHCI workloads, particularly on USB-heavy systems such as kiosks, point-of-sale terminals, and industrial gateways
- Collect and centralize dmesg output for xHCI subsystem messages to identify repeated slot disable errors
How to Mitigate CVE-2026-43432
Immediate Actions Required
- Apply the upstream Linux kernel patches replacing kfree() with xhci_free_command() in xhci_disable_slot() as soon as distribution updates are available
- Inventory all Linux systems running affected kernel versions, prioritizing servers and appliances with high USB device churn
- Schedule kernel updates and reboots for production systems, coordinating maintenance windows for long-running hosts where memory exhaustion risk is highest
Patch Information
The fix is distributed across multiple Linux stable branches. Relevant upstream commits include Linux Kernel Commit 1e800e26, Linux Kernel Commit 2e2baa8f, Linux Kernel Commit 46aea907, Linux Kernel Commit 6288baf0, Linux Kernel Commit 807e4fb5, and Linux Kernel Commit c1c8550e. Consume the corresponding patched kernel packages from your distribution vendor.
Workarounds
- Reboot affected systems periodically to reclaim leaked kernel memory until patches can be applied
- Reduce conditions that trigger the error path by ensuring stable USB hardware and avoiding fuzzing or stress workloads against USB controllers on unpatched kernels
- Restrict physical and logical access to USB ports on critical systems to limit opportunities for triggering repeated slot disable operations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
