CVE-2026-43431

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
08/05/2026
Last modified:
20/05/2026

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xhci: Fix NULL pointer dereference when reading portli debugfs files<br /> <br /> Michal reported and debgged a NULL pointer dereference bug in the<br /> recently added portli debugfs files<br /> <br /> Oops is caused when there are more port registers counted in<br /> xhci-&gt;max_ports than ports reported by Supported Protocol capabilities.<br /> This is possible if max_ports is more than maximum port number, or<br /> if there are gaps between ports of different speeds the &amp;#39;Supported<br /> Protocol&amp;#39; capabilities.<br /> <br /> In such cases port-&gt;rhub will be NULL so we can&amp;#39;t reach xhci behind it.<br /> Add an explicit NULL check for this case, and print portli in hex<br /> without dereferencing port-&gt;rhub.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.19 (including) 6.19.9 (excluding)
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*