CVE-2024-36896

What it actually does

Null pointer dereference in usb_hub_to_struct_hub() within disable_store() and disable_show() when a hub is concurrently removed, allowing access violation during port device operations.

Why it matters to the business

Kernel instability or crashes on Linux systems during USB device management, increasing downtime risk in environments with frequent device attachment or removal.

How an attack unfolds

An attacker triggers concurrent hub removal while invoking port disable operations, causing the unchecked NULL return from usb_hub_to_struct_hub() to be dereferenced and leading to a crash; the issue was identified via KASAN and syzkaller testing.

How to fix it

Update the Linux kernel to include commit 5f1d68ef5ddac27c6b997adccd1c339cef1e6848 or equivalent fixed versions in stable branches.

How to confirm the fix worked

Confirm the presence of the fix commit in the kernel source, rebuild with KASAN enabled, and retest port removal scenarios for absence of violations.

Typical attack path

1. Obtain local access to trigger USB operations
2. Initiate concurrent removal of a USB hub device
3. Invoke disable_store() or disable_show() on an associated port device
4. Trigger dereference of NULL hub pointer resulting in access violation

How to detect it

Review kernel logs for oops or panic entries referencing usb_hub_to_struct_hub, port.c, disable_store, or disable_show in the USB core subsystem.

What your security team should do

• Prioritize kernel updates to the fixed commit across all affected systems
• Monitor kernel logs for USB-related panics or oops during device hotplug events
• Limit untrusted local access to systems handling USB hubs until patched