In the Linux kernel, the following vulnerability has been resolved:
xhci: Handle TD clearing for multiple streams case
When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset properly and the caches cleared. Change the logic so that any N>1 TDs found active for different streams are deferred until after the first one is processed, calling xhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to queue another command until we are done with all of them. Also change the error/"should never happen" paths to ensure we at least clear any affected TDs, even if we can't issue a command to clear the hardware cache, and complain loudly with an xhci_warn() if this ever happens.
This problem case dates back to commit e9df17eb1408 ("USB: xhci: Correct assumptions about number of rings per endpoint.") early on in the XHCI driver's life, when stream support was first added. It was then identified but not fixed nor made into a warning in commit 674f8438c121 ("xhci: split handling halted endpoints into two steps"), which added a FIXME comment for the problem case (without materially changing the behavior as far as I can tell, though the new logic made the problem more obvious).
Then later, in commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs."), it was acknowledged again.
[Mathias: commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs.") was a targeted regression fix to the previously mentioned patch. Users reported issues with usb stuck after unmounting/disconnecting UAS devices. This rolled back the TD clearing of multiple streams to its original state.]
Apparently the commit author was aware of the problem (yet still chose to submit it): It was still mentioned as a FIXME, an xhci_dbg() was added to log the problem condition, and the remaining issue was mentioned in the commit description. The choice of making the log type xhci_dbg() for what is, at this point, a completely unhandled and known broken condition is puzzling and unfortunate, as it guarantees that no actual users would see the log in production, thereby making it nigh undebuggable (indeed, even if you turn on DEBUG, the message doesn't really hint at there being a problem at all).
It took me *months* of random xHC crashes to finally find a reliable repro and be able to do a deep dive debug session, which could all have been avoided had this unhandled, broken condition been actually reported with a warning, as it should have been as a bug intentionally left in unfixed (never mind that it shouldn't have been left in at all).
> Another fix to solve clearing the caches of all stream rings with > cancelled TDs is needed, but not as urgent.
3 years after that statement and 14 years after the original bug was introduced, I think it's finally time to fix it. And maybe next time let's not leave bugs unfixed (that are actually worse than the original bug), and let's actually get people to review kernel commits please.
Fixes xHC crashes and IOMMU faults with UAS devices when handling errors/faults. Easiest repro is to use `hdparm` to mark an early sector (e.g. 1024) on a disk as bad, then `cat /dev/sdX > /dev/null` in a loop. At least in the case of JMicron controllers, the read errors end up having to cancel two TDs (for two queued requests to different streams) and the one that didn't get cleared properly ends up faulting the xHC entirely when it tries to access DMA pages that have since been unmapped, referred to by the stale TDs. This normally happens quickly (after two or three loops). After this fix, I left the `cat` in a loop running overnight and experienced no xHC failures, with all read errors recovered properly. Repro'd and tested on an Apple M1 Mac Mini (dwc3 host).
On systems without an IOMMU, this bug would instead silently corrupt freed memory, making this a ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-modules-extraUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-develUpgrade kernel-debug-devel-matchedUpgrade libperfUpgrade kernel-devel-matchedUpgrade kernel-debugUpgrade kernel-64k-modulesUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-uki-virtUpgrade kernel-headersUpgrade rtlaUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-64k-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-coreUpgrade kernel-64k-coreUpgrade kernel-64kUpgrade kernel-modules-coreUpgrade kernel-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-coreUpgrade kernel-docUpgrade kernel-cross-headersUpgrade kernel-rt-modules-coreUpgrade kernel-64k-develUpgrade kernel-zfcpdumpUpgrade kernel-64k-modules-coreUpgrade kernelUpgrade kernel-modules-extraUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade rvUpgrade kernel-64k-debugUpgrade kernel-debug-modules-coreUpgrade bpftoolUpgrade kernel-rt-debugUpgrade kernel-toolsUpgrade perfUpgrade kernel-64k-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rt-develUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perfUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-debug-uki-virtUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-kvmUpgrade kernel-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdump-core | Aug 12, 2024 | Jul 12, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernelUpgrade python-perfUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.15.162-107.160Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade perfUpgrade kernel-headersUpgrade kernel-develUpgrade kernel-tools | May 22, 2025 | Jul 12, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfoUpgrade bpftoolUpgrade perf-debuginfoUpgrade kernel-livepatch-6.1.96-102.177Upgrade python3-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-libbpfUpgrade perfUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-x86_64 | Jun 11, 2025 | Jul 12, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 18, 2024 | Jul 12, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libs | Jun 13, 2025 | Jul 12, 2024 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Jul 1, 2025 | Jul 12, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Aug 16, 2024 | Jul 12, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Aug 12, 2024 | Jul 12, 2024 |
| Rocky_linux | — | Upgrade kernel-debug-devel-matchedUpgrade kernel-toolsUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-devel-matchedUpgrade kernel-rt-debug-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade kernel-rt-kvmUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade rvUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modules-coreUpgrade libperf-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-modules-coreUpgrade bpftoolUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-headersUpgrade kernel-debug-coreUpgrade kernelUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-debuginfoUpgrade kernel-cross-headersUpgrade rtlaUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debug-modules-coreUpgrade perf-debuginfoUpgrade kernel-modules-coreUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-develUpgrade kernel-coreUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-coreUpgrade kernel-zfcpdump-develUpgrade kernel-rt-develUpgrade kernel-debuginfoUpgrade libperfUpgrade kernel-tools-libsUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade kernel-rt-debugUpgrade kernel-modules-extra | Aug 22, 2024 | Jul 12, 2024 |
| Suse | — | Upgrade kernel-syms-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-extraUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-azureUpgrade dtb-amlogicUpgrade kernel-defaultUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade gfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade dtb-mediatekUpgrade dtb-appleUpgrade dtb-rockchipUpgrade kernel-default-baseUpgrade cluster-md-kmp-defaultUpgrade dtb-amdUpgrade dtb-nvidiaUpgrade gfs2-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt_debugUpgrade kernel-zfcpdumpUpgrade kernel-rt-vdsoUpgrade dtb-socionextUpgrade kernel-azure-develUpgrade dtb-marvellUpgrade kselftests-kmp-defaultUpgrade dtb-apmUpgrade kernel-rtUpgrade kernel-azure-extraUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-docsUpgrade kernel-macrosUpgrade kernel-syms-rtUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-symsUpgrade kselftests-kmp-rtUpgrade dtb-armUpgrade kernel-64kb-optionalUpgrade kernel-docs-htmlUpgrade kernel-obs-qaUpgrade dtb-sprdUpgrade kernel-source-rtUpgrade kernel-azure-optionalUpgrade cluster-md-kmp-64kbUpgrade kernel-devel-rtUpgrade kernel-default-livepatchUpgrade reiserfs-kmp-64kbUpgrade dtb-lgUpgrade dtb-alteraUpgrade kernel-source-vanillaUpgrade kernel-rt-optionalUpgrade kernel-obs-buildUpgrade kernel-develUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-develUpgrade dtb-qcomUpgrade dtb-hisiliconUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-azureUpgrade kernel-source-azureUpgrade dtb-freescaleUpgrade kernel-default-base-rebuildUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-debugUpgrade gfs2-kmp-azureUpgrade kernel-azureUpgrade dtb-xilinxUpgrade kernel-sourceUpgrade dtb-amazonUpgrade kselftests-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-default-vdsoUpgrade dtb-allwinnerUpgrade kernel-rt-extraUpgrade kselftests-kmp-azureUpgrade kernel-rt-develUpgrade ocfs2-kmp-64kbUpgrade dtb-caviumUpgrade gfs2-kmp-defaultUpgrade dtb-renesasUpgrade kernel-rt-livepatchUpgrade kernel-default-optionalUpgrade kernel-debug-develUpgrade dlm-kmp-64kbUpgrade kernel-64kb-extraUpgrade dtb-exynosUpgrade dtb-broadcomUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-devel | Aug 14, 2024 | Jul 12, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1062-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-121-lowlatencyUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1072-azureUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1072-azure-fdeUpgrade linux-image-5.15.0-121-generic-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-intelUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-5.15.0-1066-kvmUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-ibmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-gcpUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-5.15.0-1062-ibmUpgrade linux-image-oem-20.04Upgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidiaUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1052-gkeopUpgrade linux-image-azure-lts-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-gkeop-5.15Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.8.0-1015-awsUpgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-121-generic-lpaeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1068-gcpUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-5.15.0-1064-intel-iotgUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-5.15.0-1066-gkeUpgrade linux-image-kvmUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1064-nvidia-lowlatencyUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-oracleUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1067-oracleUpgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-45-genericUpgrade linux-image-azure-cvmUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-121-genericUpgrade linux-image-5.15.0-1069-awsUpgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-121-lowlatency-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-raspi-nolpaeUpgrade linux-image-awsUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-1064-nvidiaUpgrade linux-image-raspiUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-1010-gke | Sep 12, 2024 | Jul 12, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 9, 2025 | Jul 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub