CVE-2024-26716: usb: core: Prevent null pointer dereference in update_port_device_state
In the Linux kernel, the following vulnerability has been resolved:
usb: core: Prevent null pointer dereference in updateportdevicestate
Currently, the function updateportdevicestate gets the usbhub from udev->parent by calling usbhubtostructhub. However, in case the actconfig or the maxchild is 0, the usbhub would be NULL and upon further accessing to get portdev would result in null pointer dereference.
Fix this by introducing an if check after the usbhub is populated.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26716?
CVE-2024-26716 has been classified with a moderate severity as it can lead to unexpected behavior in the Linux kernel's USB subsystem.
How do I fix CVE-2024-26716?
To fix CVE-2024-26716, you should upgrade to the patched versions of the Linux kernel listed in the vulnerability advisory.
What versions of Linux kernel are affected by CVE-2024-26716?
CVE-2024-26716 affects multiple versions of the Linux kernel, specifically from versions 6.5 to 6.6.18 and some release candidate versions.
Is CVE-2024-26716 exploitable in a typical user environment?
While CVE-2024-26716 can be exploited, the likelihood of exploitation in a typical user environment is considered low.
What components of the Linux kernel are impacted by CVE-2024-26716?
CVE-2024-26716 impacts the USB subsystem, specifically affecting the update_port_device_state function.