CVE-2024-40903

What it actually does

A use-after-free vulnerability occurs in the Linux kernel's USB Type-C Power Delivery (TCPM) subsystem when registering source capabilities fails after unregistering existing ones, leaving a dangling pointer in port->partner_source_caps that can be dereferenced later.

Why it matters to the business

Attackers with local access could exploit this to execute arbitrary code with kernel privileges on affected Linux systems, potentially leading to full system compromise, data theft, or denial of service across servers, desktops, and embedded devices that use USB-C.

How an attack unfolds

An attacker with local access connects a malicious USB-C device or uses software to advertise invalid source capabilities. This triggers the error path in tcpm_register_source_caps after existing caps are unregistered, causing the kernel to reference freed memory which can be leveraged for code execution or privilege escalation.

How to fix it

Update the Linux kernel to version 6.1.95 or apply commit 4053696594d7235f3638d49a00cf0f289e4b36a3 from the stable git repository. Reboot the system after installing the updated kernel package from the distribution vendor.

How to confirm the fix worked

Confirm the running kernel version meets or exceeds 6.1.95 with 'uname -r'. Inspect kernel source for the pointer reset to NULL after unregistering source caps in tcpm_register_source_caps.

Typical attack path

1. Obtain local access to a vulnerable Linux system
2. Trigger USB power delivery capability registration using invalid or malicious data
3. Force the error path that leaves a dangling pointer
4. Leverage the freed memory reference for memory corruption or code execution

How to detect it

Review kernel logs (dmesg, syslog) for USB power delivery errors or crashes following device connection attempts. Examine system audit logs for unusual privilege escalations tied to USB events.

What your security team should do

• Apply kernel updates to 6.1.95 or equivalent immediately on all systems
• Monitor distribution security advisories for backported fixes
• Restrict local USB device access via policy until patches are deployed