CVE-2026-64465 Overview
CVE-2026-64465 is a Linux kernel vulnerability in the xHCI USB host controller driver. The flaw resides in xhci_free_streams(), which is invoked from the hub_event workqueue when a USB device with active stream endpoints is disconnected. The function calls xhci_free_stream_info() while holding xhci->lock with IRQs disabled. That path reaches dma_free_coherent(), which can sleep through vunmap, triggering a kernel BUG when executed in atomic context. The condition is reachable during normal USB device disconnection events on affected kernel versions.
Critical Impact
A sleep-in-atomic-context BUG in the xHCI driver can be triggered by disconnecting a USB device that uses stream endpoints, causing a kernel warning or crash and potential denial of service.
Affected Products
- Linux kernel (xHCI USB host controller driver, drivers/usb/host/xhci.c)
- Distributions shipping affected upstream kernel versions prior to the referenced stable commits
- Systems using USB devices with stream endpoints (for example, UAS storage devices)
Discovery Timeline
- 2026-07-25 - CVE-2026-64465 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64465
Vulnerability Analysis
The vulnerability is a locking and context violation in the xHCI stream endpoint teardown path. When a USB device is disconnected, usb_disconnect() walks through usb_disable_device(), bus_remove_device(), and eventually usb_unbind_interface(), which calls usb_free_streams() and then xhci_free_streams(). The driver acquires xhci->lock with interrupts disabled to protect endpoint state during cleanup.
While still holding that spinlock, xhci_free_streams() calls xhci_free_stream_info(), which in turn invokes xhci_free_stream_ctx() for each stream context array. Large stream context arrays are freed with dma_free_coherent(). On architectures and configurations where those buffers are vmapped, dma_free_coherent() reaches vunmap(), which may sleep. Sleeping while holding a spinlock with IRQs disabled trips the kernel's atomic-context checks and produces a BUG.
Root Cause
The root cause is calling a potentially sleeping DMA free routine from atomic context. The fix restructures xhci_free_streams() to save the stream_info pointers and clear the endpoint references under the lock, then drop the lock before calling xhci_free_stream_info(). Freeing the DMA-backed stream context arrays now occurs in a context where sleeping is permitted.
Attack Vector
The issue is triggered locally by disconnecting a USB device that had active stream endpoints. Any user with the ability to attach and detach USB devices, or any event that removes such a device, can reach the code path. Successful triggering results in a kernel BUG splat and potential system instability rather than remote code execution.
The vulnerable call chain is documented in the upstream commit message as: dma_free_attrs → xhci_free_stream_info → xhci_free_streams → usb_free_streams → usb_unbind_interface → device_release_driver_internal → bus_remove_device → device_del → usb_disable_device → usb_disconnect → hub_event → process_one_work.
Detection Methods for CVE-2026-64465
Indicators of Compromise
- Kernel log entries containing BUG: sleeping function called from invalid context referencing dma_free_attrs and xhci_free_stream_info
- Call traces in dmesg matching the hub_event → usb_disconnect → xhci_free_streams path
- Unexpected kernel warnings or crashes correlated with USB device disconnect events on hosts using UAS or other stream-endpoint devices
Detection Strategies
- Monitor kernel ring buffer output for the specific BUG signature involving xhci_free_stream_info and dma_free_coherent
- Compare installed kernel package versions against the fixed stable commits listed in the kernel.org stable tree
- Inventory hosts using USB attached SCSI (UAS) storage or other devices that allocate stream endpoints, as these are the primary trigger sources
Monitoring Recommendations
- Forward /var/log/kern.log and journald kernel messages to a centralized log platform and alert on sleeping function called from invalid context
- Track USB device attach and detach events via udev to correlate crashes with device removal
- Include kernel version and patch-level checks in configuration management to identify unpatched systems
How to Mitigate CVE-2026-64465
Immediate Actions Required
- Identify Linux hosts running kernel versions that predate the fix commits in the stable tree
- Apply the vendor-supplied kernel update from your distribution as soon as it becomes available
- Reboot affected systems after patching to load the corrected xHCI driver
Patch Information
The fix has been merged into multiple stable branches. Reference commits include 10666ac9c552, 1e45aa722c4c, 42c37c4b75d3, 93cd037da94f, d107eb316144, e623e4a203f5, f7b022ae0768, and f90586129cf9. The patch relocates the xhci_free_stream_info() call outside the xhci->lock critical section so the sleeping DMA free routines execute in valid context.
Workarounds
- Avoid hot-unplugging USB devices that use stream endpoints, such as UAS storage devices, on unpatched hosts
- Where feasible, restrict physical USB access on affected systems until the kernel update is deployed
- Consider disabling UAS on affected devices by using the usb-storage.quirks kernel parameter to fall back to the non-stream usb-storage driver
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
