-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================================================
FreeBSD-EN-26:22.usb                                            Errata Notice
                                                          The FreeBSD Project

Topic:          umass(4) devices may fail to attach

Category:       core
Module:         usb
Announced:      2026-09-29
Affects:        FreeBSD 14.5
Corrected:      2026-09-04 17:56:23 UTC (stable/14, 14.5-STABLE)
                2026-09-29 16:09:02 UTC (releng/14.5, 14.5-RELEASE-p1)

For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.

I.   Background

The USB mass storage driver, umass(4), provides support for various models
of thumb drives, hard drives, and other media devices that may be attached
over USB through an xhci(4) controller.

II.  Problem Description

The umass(4) driver relies on the ability to reset the USB data toggle
during normal operation.  A change to xhci(4) intended to keep the data
toggle state synchronized with the connected device inadvertently prevented
device drivers from resetting it.

III. Impact

Some umass(4) devices may fail to attach as a result of this change.  One
such failure may be surfaced via a bad CAM status, such as:

(da8:umass-sim0:0:0:0): got CAM status 0x444
(da8:umass-sim0:0:0:0): fatal error, failed to attach to device

IV.  Workaround

No workaround is available.

V.   Solution

Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date, and reboot the system.

Perform one of the following:

1) To update your system installed from binary distribution sets:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
which were not installed using base system packages can be updated via the
freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install
# shutdown -r now

2) To update your system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/EN-26:22/usb.patch
# fetch https://security.FreeBSD.org/patches/EN-26:22/usb.patch.asc
# gpg --verify usb.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch -E -p0 < /path/to/patch

c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

VI.  Correction details

This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:

Branch/path                             Hash                     Revision
- -------------------------------------------------------------------------
stable/14/                              f656bde0c2ef    stable/14-n275115
releng/14.5/                            662ed9948327  releng/14.5-n274873
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:22.usb.asc>
-----BEGIN PGP SIGNATURE-----

iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmq8DKQbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvtFEP/R2dZTqA9XizofMWKmov
818VRbgNFSZIhDy+94jhyJ2DBuLpF8wZ6PQM8ClrtVihdSUHV59s2iVra1lQcGys
D1Pq6Tm+05OiBa7RdGr7v3sNE6u4FbB5shfQ93+YrL2cXs/D/3EAH+e3cXHnSghd
AP2Ftaenj85/cOf7RzxRvPP/5OD7VeR0L9NgY/Y+uiPTTRGA8nEKT9/huEnhjmsD
/pBL+G/QsV8xl0zeyciHmX6Pb77W2PNLcz9ccOPlLat5kvkpRldtnRYm49OSWCSn
0kyHANtSgbrFtU7tdUpSeWRJ5JZN/tRMcHehdzCRF0r4g4/wwHeR4egVCVLvicjN
lMcTSpBBGO4LQXvj6icUMiDVGDSZ9Gi3Cy6QZd8ns+79ywgHqRxRIyww+NGzDTZy
JKIIFK5UwmTV0aKpJu6M0hu6srfb+Z7tZX4iTRQ2bi6xylRV20w3T7o6r9O23Ajv
hSz6cGWtrGikskDuPr60iQSkJFNTk7Nax02Frk1vKnk5NPilnCCpDmGqKDicnRhg
+LmjnrGYJ/KoFmneSXgX1mfBN5QWNvH8TNquBOe3usc96angQ+u0ZaT4PoGu5oNL
eVdElGbUQiIVpinZs0ZYuti7qNVC7fVSp9Zw42l2MH6CTSJqomN0+YCwqKyBlth0
yhESsi8P+Bv19lziNHQswgF6
=MAAG
-----END PGP SIGNATURE-----