CVE-2024-26749

What it actually does

Use-after-free read in cdns3_gadget_ep_disable when list_del_init operates on a request structure already released by cdns3_gadget_ep_free_request, allowing invalid memory access during USB gadget endpoint disable paths.

Why it matters to the business

Kernel crashes or memory corruption on systems using the cdns3 USB controller in gadget mode can cause service outages, require reboots, and create windows for further local attacks until systems are updated.

How an attack unfolds

An attacker with local access triggers USB FunctionFS endpoint disable operations that exercise the flawed disable path; the freed request list entry is then dereferenced, producing a use-after-free read that can be leveraged for kernel memory disclosure or corruption.

How to fix it

Update the Linux kernel to the commit cfa9abb5570c489dabf6f7fb3a066cc576fc8824 or later stable releases that reorder list_del_init before the free request call; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit cfa9abb5570c489dabf6f7fb3a066cc576fc8824 via git log or uname output; test USB gadget endpoint disable paths under load to verify absence of KFENCE use-after-free reports.

Typical attack path

1. Obtain local shell or user context on a Linux system using cdns3 USB gadget hardware.
2. Trigger FunctionFS or similar gadget configuration that calls ffs_func_set_alt or ffs_func_disable.
3. Cause usb_ep_disable to invoke cdns3_gadget_ep_disable and free the request before list removal.
4. Read or corrupt the dangling list pointers to escalate privileges or crash the kernel.

How to detect it

Search kernel logs for KFENCE use-after-free reads in __list_del_entry_valid or cdns3_gadget_ep_disable; inspect audit logs for unexpected USB gadget configuration changes by non-privileged processes.

• BUG: KFENCE: use-after-free read in __list_del_entry_valid
• cdns3_gadget_ep_disable+0x1f8/0x388 [cdns3]
• ffs_func_eps_disable
• ffs_func_set_alt

What your security team should do

• Prioritize patching all systems exposing cdns3 USB gadget functionality within the next maintenance window.
• Monitor kernel logs for KFENCE or KASAN use-after-free reports involving cdns3_gadget_ep_disable.
• Restrict untrusted local users from loading or configuring USB gadget drivers until patches are applied.