CVE-2024-36893

What it actually does

NULL pointer dereference in the TCPM state machine when port->partner is an error value or NULL after a failed typec_register_partner() call, causing a kernel crash during run_state_machine().

Why it matters to the business

Unexpected system crashes and loss of availability on Linux-based devices handling USB Type-C connections, increasing downtime risk for servers, embedded systems, and Android devices; widespread kernel dependency amplifies operational disruption.

How an attack unfolds

An attacker with local access triggers USB Type-C partner registration failure conditions, allowing the state machine to dereference an invalid partner pointer and crash the kernel; the listed Android kernel RCE threat actor context highlights potential for broader local-to-kernel impact on affected devices.

How to fix it

Update the Linux kernel to version 5.15.168 or apply commit 2a07e6f0ad8a6e504a3912cfe8dc859b7d0740a5 in the stable tree; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the fixed release; inspect the TCPM source for added port->partner validity checks before dereference in run_state_machine call sites.

Typical attack path

1. Obtain local access to a vulnerable Linux system with USB Type-C support
2. Trigger typec_register_partner() failure to set port->partner to NULL or error
3. Allow tcpm_state_machine_work to invoke run_state_machine without validity check
4. Cause NULL dereference leading to kernel panic and denial of service

How to detect it

Search kernel logs for oops or panic messages containing run_state_machine+0x1bc8, tcpm_state_machine_work, and references to port partner NULL dereference; correlate with USB Type-C attach events around the time of the crash.

• Unable to handle kernel NULL pointer dereference at virtual address
• run_state_machine+0x1bc8/0x1c08
• tcpm_state_machine_work+0x94/0xe4
• port->partner validity check missing

What your security team should do

• Prioritize kernel upgrades to 5.15.168 or the referenced commit across all affected systems due to the 867 days since publication
• Monitor for kernel oops reports matching the provided stack trace
• Restrict local USB Type-C device attachment where feasible until patching completes