CVE-2026-43488

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: xhci: Prevent interrupt storm on host controller error (HCE)<br /> <br /> The xHCI controller reports a Host Controller Error (HCE) in UAS Storage<br /> Device plug/unplug scenarios on Android devices. HCE is checked in<br /> xhci_irq() function and causes an interrupt storm (since the interrupt<br /> isn’t cleared), leading to severe system-level faults.<br /> <br /> When the xHC controller reports HCE in the interrupt handler, the driver<br /> only logs a warning and assumes xHC activity will stop as stated in xHCI<br /> specification. An interrupt storm does however continue on some hosts<br /> even after HCE, and only ceases after manually disabling xHC interrupt<br /> and stopping the controller by calling xhci_halt().<br /> <br /> Add xhci_halt() to xhci_irq() function where STS_HCE status is checked,<br /> mirroring the existing error handling pattern used for STS_FATAL errors.<br /> <br /> This only fixes the interrupt storm. Proper HCE recovery requires resetting<br /> and re-initializing the xHC.