CVE-2024-26964

What it actually does

Missing NULL check after kzalloc_node in xhci_map_urb_for_dma allows sg_pcopy_to_buffer to perform memcpy into a NULL pointer, resulting in a kernel crash (denial of service).

Why it matters to the business

Local users on affected Ubuntu Linux systems can trigger system-wide crashes, causing downtime and potential loss of availability for workloads relying on USB devices; the large number of downstream Ubuntu kernel packages increases exposure surface.

How an attack unfolds

An attacker with local access submits a specially constructed USB URB that forces kzalloc_node to fail inside xhci_map_urb_for_dma; the subsequent sg_pcopy_to_buffer call then dereferences the NULL buffer and crashes the kernel.

How to fix it

Upgrade the linux, linux-aws, and linux-azure packages on Ubuntu 24.04 LTS to the fixed versions 6.8.0-50.51 (linux), 6.8.0-1020.22 (linux-aws), or 6.8.0-1020.23 (linux-azure) and reboot.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the listed fixed packages; confirm the xhci driver no longer contains the unguarded kzalloc path by inspecting the source or running a reproducer that exercises URB DMA mapping under memory pressure.

Typical attack path

1. Obtain local shell or userland execution on the target system
2. Craft and submit a USB request block that triggers the allocation failure path in xhci_map_urb_for_dma
3. Kernel executes sg_pcopy_to_buffer on the NULL pointer and panics

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages containing xhci_map_urb_for_dma or sg_pcopy_to_buffer; correlate with USB device attach events under memory pressure.

• xhci_map_urb_for_dma
• sg_pcopy_to_buffer
• kzalloc_node.*NULL
• Unable to handle kernel NULL pointer dereference

What your security team should do

• Immediately schedule kernel package upgrades to the fixed versions for all Ubuntu 24.04 systems
• Prioritize systems that expose USB devices or run untrusted local workloads
• Monitor for kernel oops/panic events referencing xhci_map_urb_for_dma until patches are deployed