CVE-2024-36977

What it actually does

In DWC3 USB controllers (revisions >= 3.10a), __dwc3_stop_active_transfer skips the 1 ms wait after EndXfer when IOC is cleared, allowing request unmapping while the controller may still be accessing DMA buffers and causing SMMU faults.

Why it matters to the business

Linux-based systems (especially Android and embedded devices) using affected DWC3 USB controllers can experience unexpected crashes or faults during USB disconnect or endpoint release, increasing downtime and support costs; the issue is present across many kernel versions but carries low exploitation probability.

How an attack unfolds

An attacker with local access or control over USB gadget functions triggers an IN transfer followed immediately by soft_disconnect (e.g., via ffs_epfile_release), causing stop_active_transfer to issue EndXfer without waiting; on vulnerable revisions the controller continues accessing unmapped buffers, producing SMMU faults. No public in-the-wild exploitation by named actors is recorded for this specific flaw.

How to fix it

Upgrade the Linux kernel to a version containing commit 341eb08dbca9eae05308c442fbfab1813a44c97a (or later stable backports) so that __dwc3_stop_active_transfer unconditionally waits 1 ms after EndXfer.

How to confirm the fix worked

Confirm the running kernel contains commit 341eb08dbca9eae05308c442fbfab1813a44c97a or verify that __dwc3_stop_active_transfer now contains the unconditional 1 ms delay; test by exercising USB gadget disconnect paths while monitoring for SMMU faults.

Typical attack path

1. Queue an IN request on a USB endpoint
2. Trigger soft_disconnect (e.g., release of ffs_epfile)
3. stop_active_transfer is called with IOC cleared
4. send_gadget_ep_cmd issues EndXfer without waiting for CMDACT
5. Requests are unmapped before controller finishes
6. SMMU fault occurs on subsequent DMA access

How to detect it

Search kernel and SMMU logs for faults occurring during USB endpoint stop or gadget disconnect sequences; correlate with calls to dwc3_stop_active_transfer and ffs_epfile_release.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all affected devices
• Monitor vendor advisories for Android and embedded distributions that include the fix
• Apply the update before the next scheduled maintenance window given the low but non-zero EPSS