CVE-2026-64465

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Fix sleep in atomic context in xhcifreestreams()

When a USB device with active stream endpoints is disconnected, xhcifreestreams() is called from the hubevent workqueue to free the stream resources. It calls xhcifreestreaminfo() while holding xhci->lock with irqs disabled.

xhcifreestreaminfo() invokes xhcifreestreamctx(), which calls dmafreecoherent() for large stream context arrays.

dmafreecoherent() can sleep (e.g. via vunmap), triggering a BUG when called from atomic context.

Call trace: dmafreeattrs+0x174/0x220 xhcifreestreaminfo+0xd0/0x11c xhcifreestreams+0x278/0x37c usbfreestreams+0x98/0xc0 usbunbindinterface+0x1b8/0x2f8 devicereleasedriverinternal+0x1d4/0x2cc devicereleasedriver+0x18/0x28 busremovedevice+0x160/0x1a4 devicedel+0x1ec/0x350 usbdisabledevice+0x98/0x214 usbdisconnect+0xf0/0x35c hubevent+0xab4/0x19ec processone_work+0x278/0x63c

Fix this by saving the streaminfo pointers and clearing the ep references under the lock, then calling xhcifreestreaminfo() outside the lock where sleeping is allowed.