CVE-2024-35825

What it actually does

Improper validation of NCM USB gadget packets with wBlockLength set to zero allows repeated processing of the same NTB structure because leftover byte count is never decremented to zero, resulting in an infinite loop and kernel crash.

Why it matters to the business

Devices running affected Linux kernels that expose USB gadget NCM interfaces can experience unexpected system crashes during normal or adversarial USB host connections, leading to loss of network connectivity and service availability on embedded or mobile platforms.

How an attack unfolds

An attacker with physical or logical access to the USB port connects a host that transmits CDC-NCM frames containing zero-length block headers while still carrying valid datagrams; the gadget driver enters the faulty loop path and crashes the kernel.

How to fix it

Update the Linux kernel to the commit d8a5b80568a9cb66810e75b182018e9edb68e8ff or later; rebuild and deploy the fixed kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit d8a5b80568a9cb66810e75b182018e9edb68e8ff; attempt to reproduce the zero-block-length packet scenario in a test environment and verify no infinite loop occurs.

Typical attack path

1. Establish USB connection to target gadget exposing NCM function
2. Transmit short packets with wBlockLength=0 at intervals of several seconds
3. Trigger repeated entry into the giveback processing loop
4. Cause unbounded CPU consumption and eventual kernel panic

How to detect it

Inspect kernel logs for repeated entries around USB gadget NCM giveback handling or watchdog-induced panics following USB activity; correlate with dmesg timestamps matching connection events.

What your security team should do

• Prioritize kernel upgrades on all systems exposing USB gadget NCM interfaces
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict USB gadget exposure to trusted hosts until patches are applied