AZL-93912
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-93912.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-93912
- Upstream
- Published
- 2026-07-25T10:17:31Z
- Modified
- 2026-08-28T17:47:36.429267838Z
- Summary
- CVE-2026-64465 affecting package kernel for versions less than 6.6.145.2-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: Fix sleep in atomic context in xhcifreestreams()
When a USB device with active stream endpoints is disconnected, xhcifreestreams() is called from the hubevent workqueue to free the stream resources. It calls xhcifreestreaminfo() while holding xhci->lock with irqs disabled.
xhcifreestreaminfo() invokes xhcifreestreamctx(), which calls dmafreecoherent() for large stream context arrays.
dmafreecoherent() can sleep (e.g. via vunmap), triggering a BUG when called from atomic context.
Call trace: dmafreeattrs+0x174/0x220 xhcifreestreaminfo+0xd0/0x11c xhcifreestreams+0x278/0x37c usbfreestreams+0x98/0xc0 usbunbindinterface+0x1b8/0x2f8 devicereleasedriverinternal+0x1d4/0x2cc devicereleasedriver+0x18/0x28 busremovedevice+0x160/0x1a4 devicedel+0x1ec/0x350 usbdisabledevice+0x98/0x214 usbdisconnect+0xf0/0x35c hubevent+0xab4/0x19ec processone_work+0x278/0x63c
Fix this by saving the streaminfo pointers and clearing the ep references under the lock, then calling xhcifreestreaminfo() outside the lock where sleeping is allowed.
- References