usb: xhci: Fix memory leak in xhci_disable_slot()

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-43432
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-05-08 15:16:55 UTC
Updated2026-05-08 15:16:55 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix memory leak in xhci_disable_slot() xhci_alloc_command() allocates a command structure and, when the second argument is true, also allocates a completion structure. Currently, the error handling path in xhci_disable_slot() only frees the command structure using kfree(), causing the completion structure to leak. Use xhci_free_command() instead of kfree(). xhci_free_command() correctly frees both the command structure and the associated completion structure. Since the command structure is allocated with zero-initialization, command->in_ctx is NULL and will not be erroneously freed by xhci_free_command(). This bug was found using an experimental static analysis tool we are developing. The tool is based on the LLVM framework and is specifically designed to detect memory management issues. It is currently under active development and not yet publicly available, but we plan to open-source it after our research is published. The bug was originally detected on v6.13-rc1 using our static analysis tool, and we have verified that the issue persists in the latest mainline kernel. We performed build testing on x86_64 with allyesconfig using GCC=11.4.0. Since triggering these error paths in xhci_disable_slot() requires specific hardware conditions or abnormal state, we were unable to construct a test case to reliably trigger these specific error paths at runtime.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected fee8be5bde562d4f5f9a100ca80c6d7072ed34c8 1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62 git Not specified
CNA Linux Linux affected 02d5a2a48bb44e7404b794df87e57588b2fd604e 6288baf0c8c4dcfbf206773aede9c1f2269cec28 git Not specified
CNA Linux Linux affected 7faac1953ed1f658f719cdf7bb7303fa5eef822c 46aea90763832cd6e9b0c2e1c00e6a9512156d4b git Not specified
CNA Linux Linux affected 7faac1953ed1f658f719cdf7bb7303fa5eef822c 2e2baa8fb5aa4d080cbfeb84c51eff797529f413 git Not specified
CNA Linux Linux affected 7faac1953ed1f658f719cdf7bb7303fa5eef822c 807e4fb5140c73eb5dba1e399a990db5c1f3cdf8 git Not specified
CNA Linux Linux affected 7faac1953ed1f658f719cdf7bb7303fa5eef822c c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89 git Not specified
CNA Linux Linux affected 7faac1953ed1f658f719cdf7bb7303fa5eef822c 078b446efc0f5e496c31bccb72b98af979963a83 git Not specified
CNA Linux Linux affected 7faac1953ed1f658f719cdf7bb7303fa5eef822c c1c8550e70401159184130a1afc6261db01fc0ce git Not specified
CNA Linux Linux affected cc7c2818c71ebace207df40cc586c8c74e3d1a59 git Not specified
CNA Linux Linux affected ec0cddcc2454ab08193beb473978f8f8889b7e24 git Not specified
CNA Linux Linux affected 5.16 Not specified
CNA Linux Linux unaffected 5.16 semver Not specified
CNA Linux Linux unaffected 5.10.253 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.203 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.167 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.130 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.78 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.19 6.18.* semver Not specified
CNA Linux Linux unaffected 6.19.9 6.19.* semver Not specified
CNA Linux Linux unaffected 7.0 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/6288baf0c8c4dcfbf206773aede9c1f2269cec28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2e2baa8fb5aa4d080cbfeb84c51eff797529f413 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/078b446efc0f5e496c31bccb72b98af979963a83 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/46aea90763832cd6e9b0c2e1c00e6a9512156d4b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/807e4fb5140c73eb5dba1e399a990db5c1f3cdf8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c1c8550e70401159184130a1afc6261db01fc0ce 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report