CVE-2024-26748

What it actually does

Double-free of a USB request object in the cdns3 gadget driver when a zero-length packet request is automatically appended for transfers whose length is a multiple of the max packet size, leading to a use-after-free on subsequent access during completion handling.

Why it matters to the business

Systems using affected USB controllers may experience kernel crashes, denial of service, or potential local code execution, disrupting device operation especially in embedded, automotive, or industrial Linux deployments.

How an attack unfolds

An attacker with the ability to initiate USB gadget transfers that end on a packet boundary triggers the driver's zero-length packet helper request; the completion path frees the request once via usb_gadget_giveback_request and again via cdns3_gadget_ep_free_request, resulting in a dangling reference that can be abused for memory corruption.

How to fix it

Update the Linux kernel to commit aad6132ae6e4809e375431f8defd1521985e44e7 or later stable releases that contain the fix; rebuild and deploy the patched kernel image on all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit aad6132ae6e4809e375431f8defd1521985e44e7 by inspecting /proc/version or the kernel build log; confirm absence of the double-free path by reviewing the cdns3_gadget_giveback function for the added zero-length packet check before giveback.

Typical attack path

1. Obtain local access or control a USB host that interacts with the vulnerable cdns3 gadget
2. Queue a USB request whose length modulo max-packet-size equals zero
3. Allow the driver to append and later complete the internal zero-length packet request
4. Trigger the double-free path during giveback to corrupt kernel memory structures
5. Leverage the resulting use-after-free for privilege escalation or denial of service

How to detect it

Inspect kernel logs for KFENCE or KASAN reports referencing cdns3_gadget_giveback or cdns3_transfer_completed with use-after-free signatures; review dmesg and syslog for BUG: KFENCE or double-free messages involving the cdns3 module around USB transfer completion events.

What your security team should do

• Prioritize kernel upgrades on all devices using the cdns3 USB gadget driver
• Apply the fix within standard patch windows unless the hardware is internet-exposed or processes sensitive data
• Monitor vendor firmware updates that incorporate the upstream commit
• Limit exposure by disabling unused USB gadget functions until patches are applied