CVE-2024-26747: usb: roles: fix NULL pointer issue when put module's reference
In the Linux kernel, the following vulnerability has been resolved:
usb: roles: fix NULL pointer issue when put module's reference
In current design, usb role class driver will get usbroleswitch parent's module reference after the user get usbroleswitch device and put the reference after the user put the usbroleswitch device. However, the parent device of usbroleswitch may be removed before the user put the usbroleswitch. If so, then, NULL pointer issue will be met when the user put the parent module's reference.
This will save the module pointer in structure of usbroleswitch. Then, we don't need to find module by iterating long relations.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26747?
CVE-2024-26747 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-26747?
To fix CVE-2024-26747, you should upgrade to the patched versions of the Linux kernel: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
What components are affected by CVE-2024-26747?
CVE-2024-26747 affects the USB role class driver in the Linux kernel.
Can CVE-2024-26747 lead to further exploitation?
While CVE-2024-26747 primarily involves a NULL pointer dereference, it could potentially be leveraged in broader exploitation scenarios.
Is CVE-2024-26747 present in older kernels?
Yes, CVE-2024-26747 may be present in older versions of the Linux kernel that have not been updated.