VulnerabilityPublished 13 May 2026Updated 6 Nov 2026

CVE-2026-43488: Linux kernel · HCE

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in d6d5febd12452b7fd951fdd15c3ec262f01901a4 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:04 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in d6d5febd12452b7fd951fdd15c3ec262f01901a4, cd41e0d1df8fcf5eae294657da52b50d1ce03246, b2dd9abf8c06cfcbcf242321fd54ae51a4807705 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 13 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 2a25e66d676dfb9b018abd503deed3d38a892dec, < d6d5febd12452b7fd951fdd15c3ec262f01901a4	Fixed in d6d5febd12452b7fd951fdd15c3ec262f01901a4
LinuxLinux	Affected ≥ 2a25e66d676dfb9b018abd503deed3d38a892dec, < cd41e0d1df8fcf5eae294657da52b50d1ce03246	Fixed in cd41e0d1df8fcf5eae294657da52b50d1ce03246
LinuxLinux	Affected ≥ 2a25e66d676dfb9b018abd503deed3d38a892dec, < b2dd9abf8c06cfcbcf242321fd54ae51a4807705	Fixed in b2dd9abf8c06cfcbcf242321fd54ae51a4807705
LinuxLinux	Affected ≥ 2a25e66d676dfb9b018abd503deed3d38a892dec, < 09ff0099c6cf148ff1f7053b5b6c84beb1c2ef8d	Fixed in 09ff0099c6cf148ff1f7053b5b6c84beb1c2ef8d
LinuxLinux	Affected ≥ 2a25e66d676dfb9b018abd503deed3d38a892dec, < 6f91f3f087194c114d6d8ea4591b850bb00672f8	Fixed in 6f91f3f087194c114d6d8ea4591b850bb00672f8
LinuxLinux	Affected =6.2	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Prevent interrupt storm on host controller error (HCE) The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhci_irq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults. When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhci_halt(). Add xhci_halt() to xhci_irq() function where STS_HCE status is checked, mirroring the existing error handling pattern used for STS_FATAL errors. This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC.

References

Community reviews

Loading reviews…