CVE-2026-97430
Received Received - Intake

XHCI Command Ring Accessibility Bypass in Linux Kernel

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCD_FLAG_HW_ACCESSIBLE. HCD_FLAG_HW_ACCESSIBLE is set and cleared in suspend and resume. Also print a warning if xhci is being suspended with commands still pending on the command ring.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97430
EUVD
EUVD-2026-86043

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the xHCI (USB 3.0 host controller interface) driver. It occurs when the system tries to queue new commands to the xHCI controller while it is marked as inaccessible during suspend or resume operations. The driver now refuses to accept new commands if the controller is inaccessible, and warns if commands are still pending during suspension.

Detection Guidance

This vulnerability is specific to the Linux kernel's xhci (USB 3.0 host controller) driver. Detection involves checking kernel logs for warnings about xhci suspension with pending commands or inaccessible xHC states. Use commands like dmesg | grep xhci or journalctl -k | grep xhci to inspect logs for related warnings.

Impact Analysis

This issue may cause system instability or unexpected behavior during suspend or resume operations. It could lead to USB device malfunctions or system hangs if commands are incorrectly queued while the controller is inaccessible.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Monitor kernel logs for xhci-related warnings during system suspend/resume cycles. Ensure no critical USB operations are pending during suspend to prevent command queueing issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97430. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart