CVE-2026-97484: usbip: vhci_hcd: fix NULL deref in status_show_vhci
In the Linux kernel, the following vulnerability has been resolved:
usbip: vhcihcd: fix NULL deref in statusshowvhci
platformgetdrvdata() can return NULL if a VHCI host controller's probe failed (e.g. due to USB bus number exhaustion). statusshowvhci() checked for a NULL pdev but not for a NULL hcd returned by platformgetdrvdata(). Passing NULL to hcdtovhcihcd() does not return NULL - it returns a pointer offset of 0x260, causing a NULL pointer dereference when that value is subsequently dereferenced.
Add a NULL check on hcd before calling hcdtovhcihcd(). Move statusshownotready() above statusshowvhci() to make it callable from the new error path without a forward declaration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add a NULL check on hcd before calling hcd_to_vhci_hcd() in status_show_vhci(), because platform_get_drvdata() can return NULL.
Event History
Frequently Asked Questions
Which systems are exposed to this crash condition?
Systems are exposed when a USB/IP VHCI host controller probe has failed and its platform driver data is therefore NULL. The example given is USB bus number exhaustion during probing.
What triggers the NULL pointer dereference?
The failure occurs when the status display path runs after the failed probe. The code previously checked the platform device but did not check whether platform_get_drvdata() returned a valid host-controller pointer before converting and dereferencing it.
How can I determine whether a system may be affected?
Check whether a VHCI host-controller probe failed, particularly because USB bus numbers were exhausted. If that condition occurred, accessing the VHCI status path could trigger the dereference in the affected code.