VulnerabilityPublished 4 Sep 2026Updated 30 Oct 2026

CVE-2026-80861: Linux kernel · usb: xhci: bail out of setup if the controller is inaccessible

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in c051f66b621695ad7c8438a9497d79e1f4f05edb : update Linux kernel when convenient.

Data as of 30 Oct 2026, 13:06 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in c051f66b621695ad7c8438a9497d79e1f4f05edb, bf84c6b0264947794fa783c324a6d874ca6657d8, 78203d5b54a40f0e36196ebf31c9c7a380fc8811 +6

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 66d4eadd8d067269ea8fead1a50fe87c2979a80d, < c051f66b621695ad7c8438a9497d79e1f4f05edb	Fixed in c051f66b621695ad7c8438a9497d79e1f4f05edb
LinuxLinux	Affected ≥ 66d4eadd8d067269ea8fead1a50fe87c2979a80d, < bf84c6b0264947794fa783c324a6d874ca6657d8	Fixed in bf84c6b0264947794fa783c324a6d874ca6657d8
LinuxLinux	Affected ≥ 66d4eadd8d067269ea8fead1a50fe87c2979a80d, < 78203d5b54a40f0e36196ebf31c9c7a380fc8811	Fixed in 78203d5b54a40f0e36196ebf31c9c7a380fc8811
LinuxLinux	Affected ≥ 66d4eadd8d067269ea8fead1a50fe87c2979a80d, < 70706dbcf122940f4e3595d7ba1445004cc00074	Fixed in 70706dbcf122940f4e3595d7ba1445004cc00074
LinuxLinux	Affected ≥ 66d4eadd8d067269ea8fead1a50fe87c2979a80d, < 301f4a3303b21ea959a8294518ee883710498ac2	Fixed in 301f4a3303b21ea959a8294518ee883710498ac2
LinuxLinux	Affected ≥ 66d4eadd8d067269ea8fead1a50fe87c2979a80d, < 99e78b54cc3d70e008bd1a30d43e13d652c773e0	Fixed in 99e78b54cc3d70e008bd1a30d43e13d652c773e0

AI-suggested

A fix is available and has been applied in the Linux kernel. Systems should update to a kernel version that includes the fix identified by the listed commit hashes. No additional mitigation is required once the fix is applied.

Description

A vulnerability in the Linux kernel's xHCI USB controller driver causes a kernel oops (crash) when the controller is inaccessible. The issue arises because the driver attempts an unaligned memory access if the controller's capability register returns an invalid all-ones value, which can happen if the device is dead or removed. This leads to a fault on architectures like arm64. The flaw has been fixed by adding a check to abort setup early if the controller is inaccessible.

Impact

This vulnerability can cause a kernel crash (oops) on affected systems when a USB xHCI controller is inaccessible or dead but still probed by the driver. This can lead to system instability or denial of service on affected Linux systems, especially on arm64 architectures where unaligned device memory accesses fault.

Summary

The Linux kernel xHCI USB driver (xhci_gen_setup) reads the controller's capability length register to locate operational registers. If the USB controller is dead or has dropped off the bus, this register read returns all ones (~0), which is truncated to 0xff, causing the operational register pointer to be misaligned. Subsequent access to this misaligned pointer results in an unaligned memory access fault, particularly on arm64 architectures, causing a kernel oops. The vulnerability was observed with a Renesas uPD720201 controller failing to power up but still reaching the probe path. The fix involves reading the capability register once and aborting setup with -ENODEV if the register returns all ones, preventing the invalid pointer calculation and unaligned access.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 13:06 UTC

Technical details

References

Community reviews

Related threats