PT-2026-40695 · Linux · Linux Kernel

CVE-2026-43488 · Published 2026-05-13 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xHCI controller where a Host Controller Error (HCE) occurs during UAS Storage Device plug/unplug scenarios on Android devices. The xhci irq() function checks for HCE, but because the interrupt is not cleared, it can trigger an interrupt storm, resulting in severe system-level faults. While the driver typically logs a warning and expects activity to stop per xHCI specifications, some hosts continue the interrupt storm until the xHC interrupt is manually disabled and the controller is stopped via the xhci halt() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-43488

OESA-2026-2416

Affected Products

Linux Kernel

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43488.json · Exploit
• https://git.kernel.org/stable/c/cd41e0d1df8fcf5eae294657da52b50d1ce03246 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31708 · Security Note
• https://git.kernel.org/stable/c/b2dd9abf8c06cfcbcf242321fd54ae51a4807705 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-43488 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2416 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40324 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43171 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-43488 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31447 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68214 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31612 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43488 · Security Note