CVE-2024-27001

What it actually does

The vmk80xx USB driver in the Linux kernel performs incomplete validation of endpoint types when submitting URBs, allowing bulk or interrupt endpoints to be used in mismatched pipe configurations depending on hardware model.

Why it matters to the business

Systems using certain Comedi-supported USB data acquisition devices may experience kernel warnings or crashes when panic_on_warn is enabled; impact is limited to niche hardware and has low operational reach across typical deployments.

How an attack unfolds

An attacker with physical or logical access to connect a USB device matching the vmk80xx VID/PID triggers the driver's auto-attach path during enumeration; the driver then submits a URB with an endpoint type that fails the loose checks, producing a kernel warning that can be escalated to a crash under panic_on_warn configurations.

How to fix it

Update the Linux kernel to the commit 3a63ae0348d990e137cca04eced5b08379969ea9 or later stable releases that incorporate the usb_find_common_endpoints simplification and strict endpoint-type enforcement in vmk80xx.

How to confirm the fix worked

Confirm the driver source contains the usb_find_common_endpoints call and explicit checks that only expected endpoint types are present; verify no BOGUS urb xfer warnings appear during device attach on patched kernels.

Typical attack path

1. Connect a USB device recognized by the vmk80xx comedi driver
2. Kernel invokes usb_probe_interface and comedi_auto_config
3. vmk80xx_auto_attach calls vmk80xx_find_usb_endpoints and later vmk80xx_reset_device
4. usb_submit_urb is called with a pipe whose transfer type does not match the endpoint
5. usb core emits WARNING at urb.c:504; system may panic if panic_on_warn is set

How to detect it

Search kernel logs for the exact string 'BOGUS urb xfer, pipe' combined with 'vmk80xx' or 'usb_submit_urb' stack traces originating from vmk80xx_reset_device or vmk80xx_auto_attach; monitor udev or syslog entries during USB device enumeration for comedi driver attachment.

What your security team should do

• Apply the referenced upstream commit or a distribution kernel containing the fix
• Audit systems for presence of comedi/vmk80xx modules and disable if the hardware is not required
• Ensure panic_on_warn is not enabled on production systems unless necessary for debugging