CVE-2024-26934

What it actually does

A deadlock occurs in usb_deauthorize_interface() because it acquires a device lock on an ancestor USB device from within a sysfs attribute callback, while device_del() waits for the callback to complete before releasing the lock.

Why it matters to the business

Linux systems may experience kernel hangs or unresponsiveness during USB device management or removal, leading to operational disruptions and potential need for reboots across servers, desktops, and embedded devices.

How an attack unfolds

A local attacker triggers concurrent sysfs operations on USB interfaces while a device removal or configuration change is in progress, causing the circular lock wait that hangs the system.

How to fix it

Update the Linux kernel to include commit 8cbdd324b41528994027128207fae8100dff094f which applies sysfs_break_active_protection() to prevent the deadlock.

How to confirm the fix worked

Confirm the running kernel source or binary contains the patch that modifies interface_authorized_store() to break active sysfs protection before acquiring the device lock.

Typical attack path

1. Obtain local user access on a Linux system
2. Perform USB interface authorization via sysfs while triggering device removal
3. Cause the deadlock condition in the kernel USB core

How to detect it

Review kernel logs for indications of task hangs involving usb_deauthorize_interface or sysfs callbacks during device removal events.

What your security team should do

• Apply the upstream kernel fix or distribution update containing commit 8cbdd324b41528994027128207fae8100dff094f as soon as possible
• Restrict unprivileged local access to USB sysfs interfaces where feasible
• Monitor kernel logs for USB-related hung tasks or deadlocks