CVE-2024-26997

What it actually does

Null or invalid pointer dereference in the DDMA completion handler of the dwc2 USB host controller driver, resulting in memory corruption within the Linux kernel.

Why it matters to the business

Potential kernel crashes or system instability on affected Linux systems using dwc2 USB hardware; low likelihood of widespread exploitation reduces immediate operational risk, though kernel-level flaws can enable privilege escalation in constrained environments.

How an attack unfolds

An attacker supplies a USB device or sequence that exercises the DDMA completion path in the dwc2 driver, triggering the dereference of an uninitialized or freed variable to corrupt kernel memory or cause a panic.

How to fix it

Update the Linux kernel to the fixed commit e8f897f4afef0031fe618a8e94127a0934896aba or later; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit e8f897f4afef0031fe618a8e94127a0934896aba via git log or version string checks; test USB host functionality under load to verify absence of crashes.

Typical attack path

1. Attach or emulate a USB device that initiates DDMA transfers on a dwc2 controller
2. Trigger completion events with timing or data that leaves the variable in a dereferenceable-invalid state
3. Observe kernel memory corruption or denial of service

How to detect it

Review kernel logs for oops/panic entries mentioning dwc2 and DDMA completion; correlate with USB device insertion events in syslog or audit logs.

What your security team should do

• Prioritize kernel updates on systems exposing dwc2 USB controllers to untrusted devices
• Monitor for kernel oops or panic logs related to dwc2 DDMA paths
• Apply the fix during the next scheduled maintenance window given stable low EPSS