CVE-2024-26715

What it actually does

Race condition between gadget driver unbind on one CPU and dwc3_gadget_suspend on another allows dwc3_disconnect_gadget to dereference a NULL gadget_driver pointer after it has been cleared.

Why it matters to the business

Linux systems using DWC3 USB controllers can experience kernel crashes or instability when USB devices are rapidly connected and disconnected, affecting device reliability in embedded and server environments.

How an attack unfolds

An attacker with physical or local access repeatedly performs USB plug-out and plug-in operations while the kernel executes concurrent gadget unbind and suspend paths, winning the race to trigger the NULL dereference and cause a denial-of-service crash.

How to fix it

Apply the upstream fix in commit b562e44f507e863c6792946e4e1b1449fbbac85d or later; update to a kernel containing this commit. Disable unused USB gadget functionality where possible as a temporary mitigation.

How to confirm the fix worked

Verify the running kernel contains commit b562e44f507e863c6792946e4e1b1449fbbac85d; attempt rapid USB plug/unplug sequences under load and confirm absence of NULL dereference panics in dmesg.

Typical attack path

1. Gain local or physical access to a Linux system with DWC3 USB gadget hardware
2. Rapidly alternate USB device plug-out and plug-in operations
3. Trigger concurrent execution of gadget_unbind_driver and dwc3_suspend_common
4. Force dwc3_disconnect_gadget to read a now-NULL gadget_driver pointer

How to detect it

Inspect kernel logs (dmesg, syslog) for oops or panic messages referencing dwc3_gadget_suspend, dwc3_disconnect_gadget, or gadget_driver NULL dereference around USB connect/disconnect events.

• dwc3_gadget_suspend
• dwc3_disconnect_gadget
• gadget_driver
• NULL pointer dereference

What your security team should do

• Prioritize kernel updates containing b562e44f507e863c6792946e4e1b1449fbbac85d on all affected systems
• Restrict physical USB access on exposed devices until patched
• Monitor kernel logs for dwc3-related oops entries during USB activity