CVE-2026-64465 - Vulnerability Details

- usb: xhci: Fix sleep in atomic context in xhci_free_streams()

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Fix sleep in atomic context in xhci_free_streams()

When a USB device with active stream endpoints is disconnected,
xhci_free_streams() is called from the hub_event workqueue to
free the stream resources. It calls xhci_free_stream_info()
while holding xhci->lock with irqs disabled.

xhci_free_stream_info() invokes xhci_free_stream_ctx(), which
calls dma_free_coherent() for large stream context arrays.

dma_free_coherent() can sleep (e.g. via vunmap), triggering
a BUG when called from atomic context.

Call trace:
dma_free_attrs+0x174/0x220
xhci_free_stream_info+0xd0/0x11c
xhci_free_streams+0x278/0x37c
usb_free_streams+0x98/0xc0
usb_unbind_interface+0x1b8/0x2f8
device_release_driver_internal+0x1d4/0x2cc
device_release_driver+0x18/0x28
bus_remove_device+0x160/0x1a4
device_del+0x1ec/0x350
usb_disable_device+0x98/0x214
usb_disconnect+0xf0/0x35c
hub_event+0xab4/0x19ec
process_one_work+0x278/0x63c

Fix this by saving the stream_info pointers and clearing the
ep references under the lock, then calling xhci_free_stream_info()
outside the lock where sleeping is allowed.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A bug in the Linux kernel USB xHCI driver causes a kernel BUG when a USB device with stream endpoints is disconnected. The driver calls xhci_free_streams() from a workqueue while holding a lock with interrupts disabled. Inside, dma_free_coherent() is invoked to free large stream context arrays; this function may sleep (e.g., during memory unmapped), but sleeping is not allowed in atomic context, triggering a BUG and resulting in a kernel panic. The weakness corresponds to improper use of sleeping operations in atomic context (CWE‑413).

Affected Systems

All Linux kernel builds older than the patch commit 10666ac9c552990204e791af653abf8e9d9ff619 are potentially vulnerable. No specific kernel version range is disclosed, so any distribution running an unpatched kernel carries the risk.

Risk and Exploitability

The EPSS score is below 1 %, indicating a very low likelihood of exploitation. The CVSS score of 5.5 reflects moderate severity. The vulnerability is not listed in CISA’s KEV catalogue. Based on the description, exploitation requires local knowledge of the USB subsystem: an attacker must plug in or trigger the disconnection of a USB device with active stream endpoints to cause the kernel panic. No remote exploitation path is detailed or implied by the CVE data.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8df75f42f8e67e2851cdcf6da91640fb881defd1`	affected	< e623e4a203f56d5c57519a9a3cb29600551534ad
`8df75f42f8e67e2851cdcf6da91640fb881defd1`	affected	< d107eb316144c5fb958486e7fe604cd7f1b35cda
`8df75f42f8e67e2851cdcf6da91640fb881defd1`	affected	< 1e45aa722c4ce5663e987102aac18c8ad6a83fdd
`8df75f42f8e67e2851cdcf6da91640fb881defd1`	affected	< 10666ac9c552990204e791af653abf8e9d9ff619
`8df75f42f8e67e2851cdcf6da91640fb881defd1`	affected	< f7b022ae07685e7526fc39f387ce65b5d309dd3b
`8df75f42f8e67e2851cdcf6da91640fb881defd1`	affected	< f90586129cf9e1fbdb718ef602eea3f15dc1c31c
`8df75f42f8e67e2851cdcf6da91640fb881defd1`	affected	< 93cd037da94fcb93183bfb2457e3a56d3eb4c8f4
`8df75f42f8e67e2851cdcf6da91640fb881defd1`	affected	< 42c37c4b75d38b51d84f31a8e29427f5e06a7c2a

Linux

affected

Version	Status	Constraints
`2.6.35`	affected	—
`0`	unaffected	< 2.6.35
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8df75f42f8e67e2851cdcf6da91640fb881defd1,e623e4a203f56d5c57519a9a3cb29600551534ad)`	affected	code_commit	—
`[8df75f42f8e67e2851cdcf6da91640fb881defd1,d107eb316144c5fb958486e7fe604cd7f1b35cda)`	affected	code_commit	—
`[8df75f42f8e67e2851cdcf6da91640fb881defd1,1e45aa722c4ce5663e987102aac18c8ad6a83fdd)`	affected	code_commit	—
`[8df75f42f8e67e2851cdcf6da91640fb881defd1,10666ac9c552990204e791af653abf8e9d9ff619)`	affected	code_commit	—
`[8df75f42f8e67e2851cdcf6da91640fb881defd1,f7b022ae07685e7526fc39f387ce65b5d309dd3b)`	affected	code_commit	—
`[8df75f42f8e67e2851cdcf6da91640fb881defd1,f90586129cf9e1fbdb718ef602eea3f15dc1c31c)`	affected	code_commit	—
`[8df75f42f8e67e2851cdcf6da91640fb881defd1,93cd037da94fcb93183bfb2457e3a56d3eb4c8f4)`	affected	code_commit	—
`[8df75f42f8e67e2851cdcf6da91640fb881defd1,42c37c4b75d38b51d84f31a8e29427f5e06a7c2a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.35`	affected	semver	—
`[0,2.6.35)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version containing patch commit 10666ac9c552990204e791af653abf8e9d9ff619 or later.
Reboot the system so the patched kernel is active.
Avoid connecting USB devices with active streaming endpoints until the kernel is updated to prevent accidental crash during device removal.

Generated by OpenCVE AI on August 5, 2026 at 02:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/10666ac9c552990204e791af653abf8e9d9ff619
https://git.kernel.org/stable/c/1e45aa722c4ce5663e987102aac18c8ad6a83fdd
https://git.kernel.org/stable/c/42c37c4b75d38b51d84f31a8e29427f5e06a7c2a
https://git.kernel.org/stable/c/93cd037da94fcb93183bfb2457e3a56d3eb4c8f4
https://git.kernel.org/stable/c/d107eb316144c5fb958486e7fe604cd7f1b35cda
https://git.kernel.org/stable/c/e623e4a203f56d5c57519a9a3cb29600551534ad
https://git.kernel.org/stable/c/f7b022ae07685e7526fc39f387ce65b5d309dd3b
https://git.kernel.org/stable/c/f90586129cf9e1fbdb718ef602eea3f15dc1c31c
https://lore.kernel.org/linux-cve-announce/2026072544-CVE-2026-64465-2baa@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64465
https://www.cve.org/CVERecord?id=CVE-2026-64465

History

Wed, 05 Aug 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 30 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-413
References		https://lore.kernel.org/linux-cve-announce/2026072544-CVE-2026-64465-2baa@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64465 https://www.cve.org/CVERecord?id=CVE-2026-64465
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Mon, 27 Jul 2026 05:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhci_free_streams() When a USB device with active stream endpoints is disconnected, xhci_free_streams() is called from the hub_event workqueue to free the stream resources. It calls xhci_free_stream_info() while holding xhci->lock with irqs disabled. xhci_free_stream_info() invokes xhci_free_stream_ctx(), which calls dma_free_coherent() for large stream context arrays. dma_free_coherent() can sleep (e.g. via vunmap), triggering a BUG when called from atomic context. Call trace: dma_free_attrs+0x174/0x220 xhci_free_stream_info+0xd0/0x11c xhci_free_streams+0x278/0x37c usb_free_streams+0x98/0xc0 usb_unbind_interface+0x1b8/0x2f8 device_release_driver_internal+0x1d4/0x2cc device_release_driver+0x18/0x28 bus_remove_device+0x160/0x1a4 device_del+0x1ec/0x350 usb_disable_device+0x98/0x214 usb_disconnect+0xf0/0x35c hub_event+0xab4/0x19ec process_one_work+0x278/0x63c Fix this by saving the stream_info pointers and clearing the ep references under the lock, then calling xhci_free_stream_info() outside the lock where sleeping is allowed.
Title		usb: xhci: Fix sleep in atomic context in xhci_free_streams()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/10666ac9c552990204e791af653abf8e9d9ff619 https://git.kernel.org/stable/c/1e45aa722c4ce5663e987102aac18c8ad6a83fdd https://git.kernel.org/stable/c/42c37c4b75d38b51d84f31a8e29427f5e06a7c2a https://git.kernel.org/stable/c/93cd037da94fcb93183bfb2457e3a56d3eb4c8f4 https://git.kernel.org/stable/c/d107eb316144c5fb958486e7fe604cd7f1b35cda https://git.kernel.org/stable/c/e623e4a203f56d5c57519a9a3cb29600551534ad https://git.kernel.org/stable/c/f7b022ae07685e7526fc39f387ce65b5d309dd3b https://git.kernel.org/stable/c/f90586129cf9e1fbdb718ef602eea3f15dc1c31c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:31.160Z

Updated: 2026-07-25T08:51:31.160Z

Reserved: 2026-07-19T15:36:31.790Z

Link: CVE-2026-64465

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-25T10:17:31.763

Modified: 2026-07-25T10:17:31.763

Link: CVE-2026-64465

Redhat

Severity : Low

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64465 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-05T02:45:17Z

Weaknesses

CWE-413
Improper Resource Locking

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object