CVE-2026-64465 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: Fix sleep in atomic context in xhci_free_streams()
When a USB device with active stream endpoints is disconnected, xhci_free_streams() is called from the hub_event workqueue to free the stream resources. It calls xhci_free_stream_info() while holding xhci->lock with irqs disabled.
xhci_free_stream_info() invokes xhci_free_stream_ctx(), which calls dma_free_coherent() for large stream context arrays.
dma_free_coherent() can sleep (e.g. via vunmap), triggering a BUG when called from atomic context.
Call trace: dma_free_attrs+0x174/0x220 xhci_free_stream_info+0xd0/0x11c xhci_free_streams+0x278/0x37c usb_free_streams+0x98/0xc0 usb_unbind_interface+0x1b8/0x2f8 device_release_driver_internal+0x1d4/0x2cc device_release_driver+0x18/0x28 bus_remove_device+0x160/0x1a4 device_del+0x1ec/0x350 usb_disable_device+0x98/0x214 usb_disconnect+0xf0/0x35c hub_event+0xab4/0x19ec process_one_work+0x278/0x63c
Fix this by saving the stream_info pointers and clearing the ep references under the lock, then calling xhci_free_stream_info() outside the lock where sleeping is allowed.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability described represents a critical race condition and atomic context violation within the Linux USB host controller driver for xhci controllers. This issue manifests specifically when handling disconnection events of USB devices that utilize stream endpoints, creating a scenario where kernel memory management operations occur in inappropriate contexts. The problem stems from the improper ordering of operations within the xhci_free_streams() function which is invoked during device removal processes through the hub_event workqueue mechanism.
The technical flaw occurs due to a fundamental violation of kernel threading constraints where memory allocation and deallocation functions that may sleep are executed within atomic contexts. When xhci_free_streams() is called from the hub_event workqueue, it holds xhci->lock with interrupts disabled, creating a situation where subsequent operations cannot safely block or sleep. The function calls xhci_free_stream_info() which in turn invokes xhci_free_stream_ctx(), leading to dma_free_coherent() calls that can legitimately sleep through mechanisms like vunmap operations. This sleeping behavior directly violates the atomic context requirements imposed by holding the lock with disabled interrupts, triggering kernel BUG checks and system instability.
This vulnerability directly relates to CWE-362, which describes concurrent execution issues where a thread sleeps while holding a lock or in an atomic context, making it particularly dangerous for system stability. The operational impact extends beyond simple device disconnection failures to potentially causing complete system hangs or crashes when USB devices are removed from systems running affected kernels. The call trace demonstrates the cascading nature of this issue, showing how the problem propagates through the USB subsystem from initial hub event processing all the way to memory management operations that cannot safely execute in atomic contexts.
The fix implemented addresses this by restructuring the resource cleanup process to separate locking operations from potentially blocking memory management calls. This approach follows established kernel development practices for handling atomic context limitations and aligns with ATT&CK framework techniques related to system integrity protection where proper locking mechanisms prevent race conditions and context violations. The solution involves deferring the actual stream information freeing operations outside of the locked context, ensuring that sleeping operations occur only when appropriate kernel scheduling constraints are met.
This vulnerability demonstrates the complexity of USB subsystem management in operating systems where multiple layers of abstraction must maintain strict timing and context requirements. The fix maintains the necessary synchronization for resource cleanup while properly separating atomic operations from memory management functions that require full kernel scheduling capabilities. This approach prevents both potential deadlocks and system crashes while preserving the intended functionality of USB device stream endpoint management during disconnection events.
The resolution represents a common pattern in kernel security where careful attention to atomic context requirements prevents subtle but critical system failures. The solution maintains proper resource cleanup semantics while addressing the fundamental architectural issue that allowed sleeping operations within inappropriate contexts, ensuring robust USB subsystem behavior under all operational conditions and preventing potential exploitation scenarios that could arise from such kernel-level timing violations.