The Linux kernel's USB xHCI driver had a vulnerability (CVE-2026-64465) where the function xhci_free_streams() called xhci_free_stream_info() while holding xhci->lock with interrupts disabled. Inside xhci_free_stream_info(), xhci_free_stream_ctx() calls dma_free_coherent(), which can sleep (e.g., via vunmap). Sleeping in atomic context triggers a kernel BUG. The fix saves stream_info pointers and clears endpoint references under the lock, then calls xhci_free_stream_info() outside the lock where sleeping is permitted.

This vulnerability can cause a kernel BUG due to sleeping in atomic context, potentially leading to system instability or crashes when a USB device with active stream endpoints is disconnected. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this issue by restructuring the code to avoid sleeping in atomic context. Users should apply the official kernel updates that include this patch. Since this is a kernel-level fix, upgrading to a kernel version containing this patch is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.