CVE-2024-26659

What it actually does

Premature release of multi-TRB isochronous transfer descriptors in the xHCI driver on Babble or Buffer Overrun events allows subsequent TRBs to be freed or overwritten, causing use-after-free conditions and invalid DMA pointer errors.

Why it matters to the business

Linux systems handling USB isochronous devices may experience kernel instability, crashes, or degraded USB functionality, increasing operational downtime for affected hardware.

How an attack unfolds

A local attacker attaches a malfunctioning USB device that generates isochronous Babble or overrun events; the driver incorrectly frees the TD before the final IOC-marked TRB completes, leading to memory corruption or denial of service when remaining events are processed.

How to fix it

Update the Linux kernel to include commit 696e4112e5c1ee61996198f0ebb6ca3fab55166e or later stable releases that reuse the isoc Transaction Error handling path and correct transfer length reporting on Babble errors.

How to confirm the fix worked

Verify the running kernel contains commit 696e4112e5c1ee61996198f0ebb6ca3fab55166e; confirm absence of "Transfer event TRB DMA ptr not part of current TD" messages during isochronous transfers after applying the fix.

Typical attack path

1. Obtain local user access on a Linux system
2. Connect a USB device capable of triggering isochronous transfer errors
3. Induce Babble or Buffer Overrun events during transfer
4. Trigger premature TD release and subsequent invalid memory access

How to detect it

Search kernel logs for xHCI-related transfer event errors and DMA pointer mismatches; inspect dmesg output around USB device attach or isochronous stream failures.

• Transfer event TRB DMA ptr not part of current TD
• xhci.*Babble
• xhci.*Buffer Overrun

What your security team should do

• Prioritize kernel updates on systems with USB isochronous workloads
• Monitor kernel logs for xHCI transfer event errors
• Test USB device compatibility in a staging environment before broad deployment