CVE-2026-23009

A use-after-free vulnerability was found in the Linux kernel's xHCI USB host controller driver. The xhci_sideband_remove_endpoint() function incorrectly assumes the endpoint has a valid transfer ring and dereferences ep->ring without checking. After suspend/resume cycles where the xHCI controller loses power, or during device re-enumeration, the ring may be freed or invalid, causing a kernel crash when dereferenced.

This vulnerability was discovered during suspend/wake-up stress testing and affects systems with USB audio offload (sideband) functionality. The crash occurs when removing sideband endpoints after power state transitions that reinitialize the xHCI controller. Normal USB operation without audio offload is not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.