PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64465 Linux CVE debrief

A vulnerability in the Linux kernel's USB xHCI driver can cause a BUG when a USB device with active stream endpoints is disconnected, due to a call to dma_free_coherent() from an atomic context. The issue arises because xhci_free_streams() is called from the hub_event workqueue while holding xhci->lock with irqs disabled. This leads to xhci_free_stream_info() invoking xhci_free_stream_ctx(), which in turn calls dma_free_coherent(). To fix this, the call to xhci_free_stream_info() is moved outside the lock where sleeping is allowed, preventing the BUG. Linux system administrators and maintainers should assess exposure and apply the patch to prevent potential BUG occurrences.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-25
Original CVE updated
2026-11-03
Advisory published
2026-07-25
Advisory updated
2026-11-03

Who should care

Linux system administrators and maintainers, particularly those responsible for managing USB devices and kernel updates, should assess exposure and apply the patch to prevent potential BUG occurrences.

Why it matters

This vulnerability in the Linux kernel's USB xHCI driver can cause a BUG when a USB device with active stream endpoints is disconnected. Linux system administrators and maintainers should assess exposure and apply the patch to prevent potential issues.

  • Verify and apply kernel patches to prevent BUG occurrences
  • Inventory and monitor Linux systems for potential exposure
  • Assess and prioritize USB device disconnection and kernel update procedures

Technical summary

The Linux kernel's USB xHCI driver has a vulnerability that can cause a BUG when a USB device with active stream endpoints is disconnected. The issue arises from a call to dma_free_coherent() from an atomic context. The fix involves moving the call to xhci_free_stream_info() outside the lock where sleeping is allowed. This change prevents the BUG by allowing dma_free_coherent() to complete without being called from an atomic context. The vulnerability is resolved in the Linux kernel, and users should apply the patch to prevent potential issues.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the patch to the Linux kernel
  • Inventory Linux systems using the affected kernel version
  • Monitor for USB device disconnections and potential BUG occurrences
  • Verify kernel patch deployment status
  • Assess and prioritize USB device disconnection and kernel update procedures
  • Track exceptions and retest remediated assets
  • Document evidence of patch application and verification

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including a call trace and a description of the fix. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64465 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64465

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64465 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64465

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/10666ac9c552990204e791af653abf8e9d9ff619

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1e45aa722c4ce5663e987102aac18c8ad6a83fdd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/42c37c4b75d38b51d84f31a8e29427f5e06a7c2a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/93cd037da94fcb93183bfb2457e3a56d3eb4c8f4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d107eb316144c5fb958486e7fe604cd7f1b35cda

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e623e4a203f56d5c57519a9a3cb29600551534ad

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f7b022ae07685e7526fc39f387ce65b5d309dd3b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f90586129cf9e1fbdb718ef602eea3f15dc1c31c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.