CVE-2021-47270

What it actually does

Null pointer dereference in multiple USB gadget drivers (ecm, eem, hid, loopback, printer, rndis, serial, sourcesink, subset, tcm) when 10 Gbps cabling is used due to absent configuration handling.

Why it matters to the business

Unexpected system crashes or service interruptions can occur on devices handling high-speed USB connections, affecting availability and requiring restarts or maintenance windows.

How an attack unfolds

An attacker physically connects a 10 Gbps USB device or cable to a vulnerable kernel, causing the gadget initialization path to dereference a null pointer and trigger a crash.

How to fix it

Apply the upstream kernel fix that reuses the 5 Gbps configuration for 10 Gbps operation; update affected packages to versions containing commit f27d0ea4689c3deca5739b5f9ed45a2ddbf00b7b.

How to confirm the fix worked

Confirm presence of the configuration reuse logic in USB gadget speed handling code and test with 10 Gbps cabling to ensure no null dereference occurs.

Typical attack path

1. Attach a 10 Gbps capable USB cable or peripheral to the target system
2. Initiate USB gadget configuration for SuperSpeedPlus speeds
3. Trigger null pointer dereference during driver setup leading to kernel panic

How to detect it

Inspect kernel logs and dmesg output for null pointer dereference messages originating from USB gadget functions during high-speed device attachment.

What your security team should do

• Prioritize kernel updates containing the USB gadget 10 Gbps fix across all affected systems
• Review and restrict use of 10 Gbps USB peripherals until patches are deployed
• Monitor kernel logs for USB-related null pointer or panic events