CVE-2026-43488: Linux Kernel xHCI Controller DoS Flaw

CVE-2026-43488 Overview

CVE-2026-43488 is a Linux kernel vulnerability in the xHCI (Extensible Host Controller Interface) USB driver. The flaw triggers an interrupt storm when the xHC controller reports a Host Controller Error (HCE) during UAS (USB Attached SCSI) storage device plug and unplug operations. Affected systems experience severe system-level faults because the interrupt is never cleared. The condition has been observed on Android devices but affects the upstream Linux kernel xHCI driver. The fix adds a call to xhci_halt() inside xhci_irq() when STS_HCE is detected, mirroring the existing handling for STS_FATAL errors.

Critical Impact
An unrecoverable interrupt storm in the xHCI driver can cause sustained CPU starvation and system unresponsiveness, resulting in a denial-of-service condition on affected hosts.

Affected Products

Linux kernel xHCI USB host controller driver
Android devices using affected Linux kernel versions with xHCI
Systems running UAS storage devices on affected xHCI hosts

Discovery Timeline

2026-05-13 - CVE CVE-2026-43488 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-43488

Vulnerability Analysis

The vulnerability resides in the xHCI interrupt handler xhci_irq() within the Linux kernel USB subsystem. When the xHC controller signals a Host Controller Error through the STS_HCE status bit, the existing driver code only logs a warning. It assumes the controller will cease activity as described in the xHCI specification.

In practice, several host implementations continue to assert interrupts after raising HCE. Because the driver does not clear the interrupt or halt the controller, the CPU re-enters the interrupt handler in a tight loop. This produces an interrupt storm that consumes CPU resources and prevents normal scheduling. The condition is reliably reproduced during UAS storage device hot-plug and unplug sequences on Android devices.

The defect is a kernel driver issue rather than a memory-safety bug. The impact is availability-focused: the affected system stops servicing other work until the controller is forcibly halted. Recovery from HCE itself requires resetting and re-initializing the xHC, which the patch does not perform — the patch only stops the storm.

Root Cause

The root cause is missing error containment in xhci_irq(). The handler treats STS_HCE as informational and returns without disabling the interrupt source. When the controller continues to signal, the CPU is trapped servicing the same condition indefinitely.

Attack Vector

The condition is triggered by xHC hardware reporting STS_HCE, typically during UAS storage device plug or unplug events. Any workflow that exercises USB hot-plug on an affected host can induce the storm, including unprivileged users with physical access to USB ports.

No verified public exploitation code is available. The vulnerability mechanism is described in the upstream kernel commit messages referenced below. See Kernel Git Commit d6d5febd for the canonical fix.

Detection Methods for CVE-2026-43488

Indicators of Compromise

Kernel log entries from the xHCI driver warning about Host Controller Error (HCE) status.
Sustained 100% CPU utilization in interrupt context (%irq or %si in top/mpstat) on a single CPU servicing the USB controller IRQ.
System hangs or watchdog timeouts coinciding with USB device hot-plug or unplug events involving UAS storage.

Detection Strategies

Monitor /proc/interrupts for abnormal growth on the xHCI IRQ line over short intervals.
Parse dmesg and journald for xHCI HCE warnings followed by soft lockup or RCU stall messages.
Correlate USB hot-plug udev events with CPU saturation telemetry from host agents.

Monitoring Recommendations

Forward kernel logs to a centralized data lake and alert on xHCI HCE strings combined with soft-lockup warnings.
Track per-IRQ interrupt rate baselines and alert on outliers exceeding the baseline by an order of magnitude.
On fleets that include Android or embedded Linux devices, include USB subsystem health metrics in device posture checks.

How to Mitigate CVE-2026-43488

Immediate Actions Required

Apply the upstream Linux kernel patch that adds xhci_halt() to the STS_HCE branch of xhci_irq().
Rebuild and deploy distribution kernels that include the fix to all affected Linux and Android devices.
Reboot affected systems after patching to ensure the updated xHCI driver is loaded.

Patch Information

The fix has been merged into the mainline Linux kernel and backported to stable branches. The relevant commits are:

The change calls xhci_halt() when STS_HCE is observed, stopping the controller and preventing further spurious interrupts. Full HCE recovery still requires resetting and re-initializing the xHC.

Workarounds

Restrict physical access to USB ports on systems that cannot be patched immediately.
Avoid hot-plugging UAS storage devices on affected hosts until the fix is deployed.
Where feasible, disable the xHCI host controller in firmware on devices that do not require USB 3.x functionality.

bash

# Verify the running kernel includes the fix by checking the kernel version
# against your distribution's advisory, then confirm xhci_hcd is loaded:
uname -r
lsmod | grep xhci_hcd
dmesg | grep -i 'xhci.*HCE'