CVE-2024-26600

What it actually does

NULL pointer dereference in phy-omap-usb2 when send_srp() is NULL, causing kernel panic during gadget wakeup sequences such as ARP or UDP transmission in peripheral-only USB configurations.

Why it matters to the business

Denial of service on affected Linux systems using USB Ethernet gadgets or similar peripherals, leading to unplanned reboots and service interruption; urgency is moderate given low EPSS and lack of known exploitation despite long public disclosure.

How an attack unfolds

An attacker with local code execution or the ability to trigger network activity on a vulnerable USB gadget (for example via ARP solicitation) causes the kernel to invoke an unimplemented send_srp() function pointer, resulting in execution at address zero and a crash. No named threat actors have been observed exploiting this specific flaw.

How to fix it

Apply the upstream fix present in commit 486218c11e8d1c8f515a3bdd70d62203609d4b6b or later; update the Linux kernel to a version containing this change. For USB peripheral-only setups, ensure the PHY driver checks for non-NULL send_srp() and set_vbus() before invocation.

How to confirm the fix worked

Confirm the kernel source contains the added NULL checks for send_srp() and set_vbus() prior to calling them; reproduce the original gadget wakeup sequence and verify absence of the NULL dereference oops.

Typical attack path

1. Obtain local access or trigger network traffic on an affected USB gadget device
2. Initiate ARP resolution or UDP transmission that reaches usb_gadget_wakeup
3. Call path reaches musb_gadget_wakeup which dereferences a NULL send_srp pointer
4. Kernel panics with NULL pointer dereference at virtual address 0x0

How to detect it

Search kernel logs for oops or panic messages containing musb_gadget_wakeup, usb_gadget_wakeup, eth_start_xmit, and NULL pointer dereference at virtual address 00000000; inspect dmesg or syslog for the exact call chain involving u_ether and musb_hdrc during gadget suspend/resume events.

• Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute
• PC is at 0x0
• LR is at musb_gadget_wakeup
• musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup
• eth_start_xmit [u_ether] from dev_hard_start_xmit

What your security team should do

• Prioritize kernel updates on systems exposing USB gadget functionality such as Ethernet or mass storage
• Monitor for kernel oops reports matching the described stack trace until patches are deployed
• Limit exposure by disabling unnecessary USB gadget configurations on production systems