CVE-2026-43431

xhci: Fix NULL pointer dereference when reading portli debugfs files

published May 8, 2026

CVSS
—
EPSS
0%
Percentile
3.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

xhci: Fix NULL pointer dereference when reading portli debugfs files

Michal reported and debgged a NULL pointer dereference bug in the

recently added portli debugfs files

Oops is caused when there are more port registers counted in

xhci->max_ports than ports reported by Supported Protocol capabilities.

This is possible if max_ports is more than maximum port number, or

if there are gaps between ports of different speeds the 'Supported

Protocol' capabilities.

In such cases port->rhub will be NULL so we can't reach xhci behind it.

Add an explicit NULL check for this case, and print portli in hex

without dereferencing port->rhub.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00143 · 3.3th percentile
Published
2026-05-08T14:22Z
EPSS history
Timeline
  • 08 MAY 14:22Z
    xhci: Fix NULL pointer dereference when reading portli debugfs files
    cvelistv5