https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:10:42 +0000 https://vulnerability.circl.lu/vuln/cve-2024-40927 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xhci: Handle TD clearing for multiple streams case</p> <p>When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset properly and the caches cleared. Change the logic so that any N&gt;1 TDs found active for different streams are deferred until after the first one is processed, calling xhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to queue another command until we are done with all of them. Also change the error/&#34;should never happen&#34; paths to ensure we at least clear any affected TDs, even if we can&#39;t issue a command to clear the hardware cache, and complain loudly with an xhci_warn() if this ever happens.</p> <p>This problem case dates back to commit e9df17eb1408 (&#34;USB: xhci: Correct assumptions about number of rings per endpoint.&#34;) early on in the XHCI driver&#39;s life, when stream support was first added. It was then identified but not fixed nor made into a warning in commit 674f8438c121 (&#34;xhci: split handling halted endpoints into two steps&#34;), which added a FIXME comment for the problem case (without materially changing the behavior as far as I can tell, though the new logic made the problem more obvious).</p> <p>Then later, in commit 94f339147fc3 (&#34;xhci: Fix failure to give back some cached cancelled URBs.&#34;), it was acknowledged again.</p> <p>[Mathias: commit 94f339147fc3 (&#34;xhci: Fix failure to…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xhci: Handle TD clearing for multiple streams case</p> <p>When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset properly and the caches cleared. Change the logic so that any N&gt;1 TDs found active for different streams are deferred until after the first one is processed, calling xhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to queue another command until we are done with all of them. Also change the error/&#34;should never happen&#34; paths to ensure we at least clear any affected TDs, even if we can&#39;t issue a command to clear the hardware cache, and complain loudly with an xhci_warn() if this ever happens.</p> <p>This problem case dates back to commit e9df17eb1408 (&#34;USB: xhci: Correct assumptions about number of rings per endpoint.&#34;) early on in the XHCI driver&#39;s life, when stream support was first added. It was then identified but not fixed nor made into a warning in commit 674f8438c121 (&#34;xhci: split handling halted endpoints into two steps&#34;), which added a FIXME comment for the problem case (without materially changing the behavior as far as I can tell, though the new logic made the problem more obvious).</p> <p>Then later, in commit 94f339147fc3 (&#34;xhci: Fix failure to give back some cached cancelled URBs.&#34;), it was acknowledged again.</p> <p>[Mathias: commit 94f339147fc3 (&#34;xhci: Fix failure to…</p> https://vulnerability.circl.lu/vuln/cve-2024-40927