CVE-2026-90015 Linux CVE debrief

Who should care

Linux system administrators, security teams, and developers responsible for maintaining and securing Linux-based systems should assess exposure based on installed versions, verify and apply patches, and monitor for potential data corruption or leaks. They should review Linux kernel versions, verify and apply patches from Linux vendors for the xhci driver, and monitor for potential data corruption or leaks in bulk transfers. Additionally, they should check

Why it matters

A vulnerability in the Linux kernel's xhci driver can cause lost bounce buffers on transfer descriptors (TDs) that span multiple ring segments, potentially leading to data corruption or leaks in bulk transfers. Linux system administrators, security teams, and developers should assess exposure based on installed versions, verify and apply patches, and monitor for potential data corruption or leaks.

• Data corruption or leaks in bulk transfers
• Potential for silent data loss or tampering
• Need for verification of affected versions and patch application
• Potential impact on data integrity in Linux-based systems

Technical summary

The Linux kernel's xhci driver has a vulnerability that can cause lost bounce buffers on transfer descriptors (TDs) spanning multiple ring segments. This can lead to data corruption or leaks in bulk transfers. The issue arises when a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, causing xhci_align_td() to stage the unalignable tail through the bounce buffer of the ring segment holding that link TRB. As a result, xhci_unmap_td_bounce_buffer() later unmaps it and, for IN transfers, copies the data back into the URB's buffer. However, the enqueue path only records the segment that was bounced in td->bounce_seg, under the assumption that a TD never spans more than two ring

Defensive priority

Medium

Recommended defensive actions

• Review Linux kernel versions and assess exposure based on installed versions
• Verify and apply patches from Linux vendors for the xhci driver
• Monitor for potential data corruption or leaks in bulk transfers
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor
• Review compensating controls for exposed systems while remediation is scheduled and verified. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, but the scope of affected versions and potential impact requires verification from official Linux sources. The Linux kernel's xhci driver has a vulnerability that can cause lost bounce buffers on transfer descriptors (TDs) spanning multiple ring segments. This can lead to data corruption or leaks in bulk transfers. To verify and apply patches, Linux system administrators, security teams, and developers should assess exposure based on installed versions and monitor

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.