CVE-2026-80861

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: bail out of setup if the controller is inaccessible

xhci_gen_setup() locates the operational registers using the capability

length read from the very first register:

xhci->op_regs = hcd->regs +

HC_LENGTH(readl(&xhci->cap_regs->hc_capbase));

If the controller is dead or has dropped off the bus, that read returns

~0, HC_LENGTH() truncates it to 0xff, and op_regs ends up 0xff bytes

past the page-aligned MMIO base, i.e. unaligned. The first access

through it, xhci_halt() -> xhci_handshake() reading op_regs->status, is

then an unaligned readl() on device memory. arm64 faults on unaligned

device accesses, so instead of xhci_handshake() catching the all-ones

value and returning -ENODEV, setup oopses:

xhci-pci-renesas 0005:08:00.0: Unable to change power state from D3cold to D0, device inaccessible

xhci-pci-renesas 0005:08:00.0: xHCI Host Controller

xhci-pci-renesas 0005:08:00.0: new USB bus registered

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References