PT-2026-64686 · Linux · Linux
CVE-2026-64465
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: Fix sleep in atomic context in xhci free streams()
When a USB device with active stream endpoints is disconnected,
xhci free streams() is called from the hub event workqueue to
free the stream resources. It calls xhci free stream info()
while holding xhci->lock with irqs disabled.
xhci free stream info() invokes xhci free stream ctx(), which
calls dma free coherent() for large stream context arrays.
dma free coherent() can sleep (e.g. via vunmap), triggering
a BUG when called from atomic context.
Call trace:
dma free attrs+0x174/0x220
xhci free stream info+0xd0/0x11c
xhci free streams+0x278/0x37c
usb free streams+0x98/0xc0
usb unbind interface+0x1b8/0x2f8
device release driver internal+0x1d4/0x2cc
device release driver+0x18/0x28
bus remove device+0x160/0x1a4
device del+0x1ec/0x350
usb disable device+0x98/0x214
usb disconnect+0xf0/0x35c
hub event+0xab4/0x19ec
process one work+0x278/0x63c
Fix this by saving the stream info pointers and clearing the
ep references under the lock, then calling xhci free stream info()
outside the lock where sleeping is allowed.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux