CVE-2026-23009Expired Pointer Dereference in Linux

Severity
5.5MEDIUMNVD
EPSS
0.0%
top 94.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 25

Description

In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: don't dereference freed ring when removing sideband endpoint xhci_sideband_remove_endpoint() incorrecly assumes that the endpoint is running and has a valid transfer ring. Lianqin reported a crash during suspend/wake-up stress testing, and found the cause to be dereferencing a non-existing transfer ring 'ep->ring' during xhci_sideband_remove_endpoint(). The endpoint and its ring may be in unknown state if thi

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

Linuxlinux/linux_kernel6.16.06.18.7
NVDlinux/linux_kernel6.16.16.18.7+2
Debianlinux/linux_kernel< 6.18.8-1
CVEListV5linux/linuxde66754e9f8029f8ae955a588959b99cab56b50634f6634dba87ef72b3c3a3a524be663adef7ab42+2
debiandebian/linux< linux 6.18.8-1 (forky)

Patches

🔴Vulnerability Details

3
OSV
CVE-2026-23009: In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: don't dereference freed ring when removing sideband endpoint xhci_2026-01-25
GHSA
GHSA-h2fj-cf53-2c8q: In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: don't dereference freed ring when removing sideband endpoint xhc2026-01-25
OSV
xhci: sideband: don't dereference freed ring when removing sideband endpoint2026-01-25

📋Vendor Advisories

2
Red Hat
kernel: xhci: sideband: don't dereference freed ring when removing sideband endpoint2026-01-25
Debian
CVE-2026-23009: linux - In the Linux kernel, the following vulnerability has been resolved: xhci: sideb...2026

🕵️Threat Intelligence

1
Wiz
CVE-2026-23009 Impact, Exploitability, and Mitigation Steps | Wiz
CVE-2026-23009 — Expired Pointer Dereference in Linux | cvebase