CVE-2024-26716

What it actually does

Null pointer dereference in Linux kernel USB core when usb_hub_to_struct_hub returns NULL due to missing actconfig or maxchild==0, causing crash on subsequent port_dev access in update_port_device_state.

Why it matters to the business

Kernel panics or system instability on Linux hosts during USB device enumeration or state changes, leading to downtime and potential data loss in affected environments.

How an attack unfolds

An attacker supplies a USB device or configuration that triggers update_port_device_state with a parent udev lacking actconfig or having maxchild of 0, causing the NULL hub dereference and denial of service; no public exploitation or threat actor involvement observed.

How to fix it

Apply the upstream fix that adds an explicit NULL check after obtaining the usb_hub; update to a kernel containing commit fc0c8cfa492b2d7b82263e71e486f3829ad7c43a or later equivalent distribution patch.

How to confirm the fix worked

Confirm the NULL check exists after usb_hub population in update_port_device_state; test by attaching USB devices that previously triggered the condition and verify no dereference occurs.

Typical attack path

1. Attacker connects crafted or malformed USB device to target system
2. Kernel USB core calls update_port_device_state during enumeration
3. usb_hub_to_struct_hub returns NULL because actconfig or maxchild is zero
4. Code proceeds to dereference the NULL pointer for port_dev access
5. Resulting kernel panic or crash denies service

How to detect it

Inspect kernel logs for null pointer dereference oops in usb core functions around update_port_device_state; correlate with USB device attach events in dmesg or journalctl.

• update_port_device_state
• usb_hub_to_struct_hub
• null pointer dereference
• actconfig
• maxchild

What your security team should do

• Prioritize kernel updates on all Linux systems that handle USB devices
• Monitor for distribution-specific backports of the USB core fix
• Restrict untrusted USB device attachment until patched
• Review logs for USB-related kernel oops or null dereference events