CVE-2021-47267

What it actually does

Null pointer dereference in usb_assign_descriptors when a gadget driver supplies a NULL super-speed-plus descriptor and the kernel later encounters a 10 Gbps capable port+cable+host combination.

Why it matters to the business

Unexpected kernel crashes on systems using USB gadget drivers with high-speed cabling, causing service interruption and requiring manual recovery.

How an attack unfolds

An attacker physically connects or emulates a 10 Gbps USB device to a vulnerable Linux gadget that omitted the super-speed-plus descriptor; the kernel dereferences the NULL pointer and panics.

How to fix it

Apply the upstream fix that falls back to the 5 Gbps descriptor when the 10 Gbps descriptor is absent; rebuild and deploy updated kernels on all affected systems.

How to confirm the fix worked

Confirm the patched kernel no longer panics when a 10 Gbps port+cable+host combination is presented to any gadget that previously supplied a NULL super-speed-plus descriptor.

Typical attack path

1. Identify or configure a Linux USB gadget lacking a 10 Gbps descriptor
2. Attach or emulate 10 Gbps capable USB hardware
3. Trigger usb_assign_descriptors path that assumes a non-NULL super-speed-plus pointer
4. Cause kernel panic via NULL dereference

How to detect it

Search kernel logs and crash dumps for USB descriptor assignment paths that end in NULL pointer dereference; correlate with 10 Gbps USB device attachment events.

• usb_assign_descriptors
• NULL pointer dereference
• super-speed-plus descriptor

What your security team should do

• Prioritize kernel updates on any host exposing USB gadget functionality
• Audit custom gadget drivers for missing super-speed-plus descriptors
• Monitor kernel logs for USB-related NULL pointer oops until patches are applied