CVE-2024-41035

What it actually does

Failure to clear reserved bits in USB endpoint descriptor bEndpointAddress causes endpoint_is_duplicate() and related checks to treat descriptors with identical endpoint numbers and directions as distinct, allowing mismatched endpoint types (e.g., interrupt vs. bulk) to coexist in device configuration.

Why it matters to the business

USB device handling can become unreliable on affected Linux systems, leading to configuration errors, unexpected device behavior, or kernel instability that disrupts peripherals and requires kernel updates across fleets.

How an attack unfolds

An attacker supplies a crafted USB device descriptor containing non-zero reserved bits in bEndpointAddress; during parsing, usb_parse_endpoint() uses the original descriptor for duplicate checks, causing the kernel to misclassify endpoints and potentially trigger confusion or crashes in USB core logic.

How to fix it

Update the Linux kernel to a version containing commit 64291f7db5bd8150a74ad2036f1037e6a0428df2 or later; rebuild and deploy the fixed kernel across all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 64291f7db5bd8150a74ad2036f1037e6a0428df2; test USB device enumeration with descriptors containing reserved bits set and confirm duplicate detection behaves correctly.

Typical attack path

1. Connect a malicious or emulated USB device exposing a crafted endpoint descriptor with reserved bits set
2. Kernel parses the descriptor in usb_parse_endpoint() without clearing reserved bits
3. endpoint_is_duplicate() incorrectly treats endpoints as unique despite matching number and direction
4. Resulting configuration mismatch leads to incorrect endpoint handling or kernel fault

How to detect it

Inspect kernel logs for USB parsing warnings or faults during device enumeration; look for unexpected endpoint type mismatches in usbcore debug output on systems that have processed untrusted USB devices.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all production systems
• Monitor upstream stable and distribution kernel updates for backports
• Test USB device hot-plug and enumeration after patching
• Review any custom USB gadget or host drivers for similar descriptor handling assumptions