CVE-2026-80861: Linux Kernel xHCI Buffer Overflow Vulnerability

CVE-2026-80861 Overview

CVE-2026-80861 is a Linux kernel vulnerability in the xhci_gen_setup() function of the USB xHCI host controller driver. When an xHCI controller is dead, powered off, or has dropped off the bus, the initial read of the capability register returns all-ones (~0). The driver then computes the operational register base using HC_LENGTH(), which truncates the value to 0xff, producing an unaligned pointer. On arm64, the subsequent unaligned MMIO access in xhci_halt() triggers an alignment fault and kernel oops rather than clean error handling.

Critical Impact
A failing or hot-removed xHCI controller can crash the kernel on arm64 systems during USB host controller probe, causing denial of service.

Affected Products

Linux kernel USB xHCI host controller driver (xhci-hcd)
Systems using Renesas uPD720201 and similar xHCI PCIe controllers
arm64 platforms that fault on unaligned device memory accesses

Discovery Timeline

2026-09-04 - CVE-2026-80861 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80861

Vulnerability Analysis

The xHCI driver locates operational registers by reading the capability base register and passing it through the HC_LENGTH() macro. The relevant line is:

xhci->op_regs = hcd->regs + HC_LENGTH(readl(&xhci->cap_regs->hc_capbase));

If the controller is inaccessible, readl() returns 0xFFFFFFFF. HC_LENGTH() masks the low byte, producing 0xff. The op_regs pointer therefore lands 255 bytes past a page-aligned MMIO base, which is not naturally aligned for a readl(). The first access through op_regs->status occurs inside xhci_halt() via xhci_handshake().

On arm64, unaligned accesses to device memory raise a synchronous alignment fault (ESR = 0x0000000096000021, FSC = 0x21). Instead of xhci_handshake() observing the all-ones sentinel and returning -ENODEV, the kernel oopses inside xhci_halt during xhci_gen_setup → xhci_pci_setup → usb_add_hcd.

Root Cause

The root cause is missing validation of the capability register read before its value is used to derive pointer arithmetic. The driver assumes hc_capbase holds a plausible controller-reported length, but a dead or removed device returns ~0, which propagates into an unaligned pointer. This is a boundary condition error combined with a null-check-equivalent omission for the sentinel value.

Attack Vector

This vulnerability is triggered by hardware state, not by network or user input. A device that fails to transition from D3cold to D0, a hot-removed xHCI controller, or a controller in a wedged state during probe can trigger the fault. The reported case involves a Renesas uPD720201 that logged "Unable to change power state from D3cold to D0, device inaccessible" yet still reached the host controller driver probe path. Local attackers with the ability to induce PCIe device removal or power state failures on arm64 hosts can leverage this for denial of service.

The fix reads the capability register once into a local variable, checks it against ~0, and aborts setup with -ENODEV before op_regs is derived. Reading it once also prevents inconsistency across a concurrent hot-removal.

Detection Methods for CVE-2026-80861

Indicators of Compromise

Kernel log entries containing Unable to change power state from D3cold to D0, device inaccessible from an xHCI PCI device.
Kernel oops with Unable to handle kernel paging request and alignment fault originating in xhci_halt or xhci_gen_setup.
Synchronous exception with ESR = 0x0000000096000021 and FSC = 0x21 on arm64 systems during USB subsystem initialization.

Detection Strategies

Monitor dmesg and journald output for xHCI probe failures accompanied by kernel oops traces.
Correlate PCIe AER (Advanced Error Reporting) events with USB host controller probe failures.
Track unexpected reboots on arm64 hosts that coincide with USB device enumeration.

Monitoring Recommendations

Ingest kernel ring buffer logs into a centralized log platform and alert on xhci_hcd oops signatures.
Track kernel version inventory across arm64 fleets to identify hosts running unpatched xHCI drivers.
Alert on repeated D3cold-to-D0 transition failures for PCIe USB controllers, which can precede a crash.

How to Mitigate CVE-2026-80861

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits 0b31744f, 78203d5b, bf84c6b, and c051f66b.
Prioritize patching on arm64 systems that use PCIe xHCI controllers, particularly Renesas uPD720201 hardware.
Rebuild and redeploy any custom kernel builds that include the xHCI host controller driver.

Patch Information

The fix reads xhci->cap_regs->hc_capbase once, tests for the ~0 sentinel value, and returns -ENODEV before deriving op_regs. Reading the register a single time also mitigates races with concurrent hot-removal. Patches are available in the mainline and stable Linux kernel trees via the following commits: Kernel Git Commit 0b31744f, Kernel Git Commit 78203d5b, Kernel Git Commit bf84c6b, and Kernel Git Commit c051f66b.

Workarounds

Physically remove or disable unreliable xHCI PCIe controllers if patching cannot be scheduled immediately.
Disable the xhci_pci module on arm64 systems where the affected controller is not required for operation.
Avoid hot-removing xHCI PCIe devices during boot or driver probe on unpatched arm64 kernels.

bash

# Blacklist the xhci_pci driver on arm64 hosts that do not require it
echo "blacklist xhci_pci" | sudo tee /etc/modprobe.d/blacklist-xhci.conf
sudo update-initramfs -u

# Verify the running kernel version to confirm patch level
uname -r