CVE-2024-26747

What it actually does

NULL pointer dereference in usb_role_switch handling when parent device is removed before module reference release, leading to kernel memory corruption or panic.

Why it matters to the business

Unexpected system crashes or instability on Linux kernels during USB role switch operations, potentially causing downtime for servers, embedded devices, or workstations relying on dynamic USB configuration.

How an attack unfolds

An attacker with local access triggers USB device or parent module removal timing while a usb_role_switch reference is held, causing the subsequent put operation to dereference a now-NULL module pointer.

How to fix it

Upgrade the Linux kernel to a version containing commit e279bf8e51893e1fe160b3d8126ef2dd00f661e1 or later; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm kernel source includes the usb_role_switch structure change storing the module pointer directly; test USB role switch attach/detach cycles post-upgrade for absence of NULL dereference panics.

Typical attack path

1. Obtain local access or execute code on target Linux system
2. Manipulate USB role switch device acquisition and parent device removal sequence
3. Trigger reference put after parent removal to hit NULL dereference

How to detect it

Review kernel logs for NULL pointer dereference oops involving usb_role_switch or module_put; inspect USB subsystem traces around device removal events.

What your security team should do

• Prioritize kernel updates on systems exposing USB role switching functionality
• Monitor for kernel oops or panic logs related to usb roles
• Apply updates within standard patch windows given low EPSS and no KEV listing