CVE-2026-43488 - Vulnerability Details

- usb: xhci: Prevent interrupt storm on host controller error (HCE)

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Prevent interrupt storm on host controller error (HCE)

The xHCI controller reports a Host Controller Error (HCE) in UAS Storage
Device plug/unplug scenarios on Android devices. HCE is checked in
xhci_irq() function and causes an interrupt storm (since the interrupt
isn’t cleared), leading to severe system-level faults.

When the xHC controller reports HCE in the interrupt handler, the driver
only logs a warning and assumes xHC activity will stop as stated in xHCI
specification. An interrupt storm does however continue on some hosts
even after HCE, and only ceases after manually disabling xHC interrupt
and stopping the controller by calling xhci_halt().

Add xhci_halt() to xhci_irq() function where STS_HCE status is checked,
mirroring the existing error handling pattern used for STS_FATAL errors.

This only fixes the interrupt storm. Proper HCE recovery requires resetting
and re-initializing the xHC.

Published: 2026-05-13

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability exists in the Linux kernel’s xHCI USB controller driver. When a Host Controller Error (HCE) occurs during plug or unplug of a USB storage device, the driver logs a warning but fails to clear the interrupt flag. This causes the interrupt line to remain asserted, leading to an interrupt storm that repeatedly invokes the interrupt handler and exhausts CPU resources. The effect is a severe system fault that effectively disables normal operation. The underlying weakness corresponds to CWE‑770, Maximum Resource Consumption.

Affected Systems

All Linux kernel versions that contain the unpatched xHCI code are affected, including those used on Android devices and other systems that rely on the default xHCI driver for device plug/unplug events. No specific kernel release numbers are listed, so administrators should assume any kernel built from mainline code before the patch commit is vulnerable.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is unavailable, though the vulnerability is not listed in the CISA KEV catalog. An attacker could trigger the flaw by inserting or removing a USB storage device on a vulnerable host, initiating the interrupt storm. The issue is local to the device and does not enable remote code execution or privilege escalation, but it presents a high impact denial of service that disrupts system availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2a25e66d676dfb9b018abd503deed3d38a892dec`	affected	< b2dd9abf8c06cfcbcf242321fd54ae51a4807705
`2a25e66d676dfb9b018abd503deed3d38a892dec`	affected	< 6f91f3f087194c114d6d8ea4591b850bb00672f8
`2a25e66d676dfb9b018abd503deed3d38a892dec`	affected	< cd41e0d1df8fcf5eae294657da52b50d1ce03246
`2a25e66d676dfb9b018abd503deed3d38a892dec`	affected	< 09ff0099c6cf148ff1f7053b5b6c84beb1c2ef8d
`2a25e66d676dfb9b018abd503deed3d38a892dec`	affected	< d6d5febd12452b7fd951fdd15c3ec262f01901a4

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.19`	unaffected	≤ 6.18.*
`6.19.9`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b2dd9abf8c06cfcbcf242321fd54ae51a4807705)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6f91f3f087194c114d6d8ea4591b850bb00672f8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cd41e0d1df8fcf5eae294657da52b50d1ce03246)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,09ff0099c6cf148ff1f7053b5b6c84beb1c2ef8d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d6d5febd12452b7fd951fdd15c3ec262f01901a4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.19,6.19.0)`	unaffected	semver	—
`[6.19.9,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the fix for HCE interrupt storms, which adds a call to xhci_halt() in the interrupt handler.
If a kernel update cannot be applied immediately, reboot the system after ensuring no USB devices are connected, then disable the xHCI driver by unbinding from /sys/bus/pci/drivers/xhci_hcd or by booting with the kernel parameter xhci_hcd=off to prevent the driver from handling interrupts.
Monitor system logs for repeated HCE warnings; if the interrupt storm still occurs, consider disabling USB 3.0 ports or using a stable kernel branch deemed secure until the patch is available.

Generated by OpenCVE AI on May 14, 2026 at 13:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00024.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/09ff0099c6cf148ff1f7053b5b6c84beb1c2ef8d
https://git.kernel.org/stable/c/6f91f3f087194c114d6d8ea4591b850bb00672f8
https://git.kernel.org/stable/c/b2dd9abf8c06cfcbcf242321fd54ae51a4807705
https://git.kernel.org/stable/c/cd41e0d1df8fcf5eae294657da52b50d1ce03246
https://git.kernel.org/stable/c/d6d5febd12452b7fd951fdd15c3ec262f01901a4
https://lore.kernel.org/linux-cve-announce/2026051350-CVE-2026-43488-ebef@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43488
https://www.cve.org/CVERecord?id=CVE-2026-43488

History

Thu, 14 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-390
References		https://lore.kernel.org/linux-cve-announce/2026051350-CVE-2026-43488-ebef@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43488 https://www.cve.org/CVERecord?id=CVE-2026-43488
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 13 May 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770

Wed, 13 May 2026 15:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Prevent interrupt storm on host controller error (HCE) The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhci_irq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults. When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhci_halt(). Add xhci_halt() to xhci_irq() function where STS_HCE status is checked, mirroring the existing error handling pattern used for STS_FATAL errors. This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC.
Title		usb: xhci: Prevent interrupt storm on host controller error (HCE)
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/09ff0099c6cf148ff1f7053b5b6c84beb1c2ef8d https://git.kernel.org/stable/c/6f91f3f087194c114d6d8ea4591b850bb00672f8 https://git.kernel.org/stable/c/b2dd9abf8c06cfcbcf242321fd54ae51a4807705 https://git.kernel.org/stable/c/cd41e0d1df8fcf5eae294657da52b50d1ce03246 https://git.kernel.org/stable/c/d6d5febd12452b7fd951fdd15c3ec262f01901a4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-13T15:08:33.196Z

Updated: 2026-05-14T14:31:22.390Z

Reserved: 2026-05-01T14:12:56.012Z

Link: CVE-2026-43488

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-13T16:16:52.107

Modified: 2026-05-22T16:33:17.283

Link: CVE-2026-43488

Redhat

Severity : Low

Publid Date: 2026-05-13T00:00:00Z

Links: CVE-2026-43488 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-14T13:30:06Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object