CVE-2024-41097

What it actually does

The cxacru_bind() function in the Linux kernel USB ATM driver performs incomplete validation of USB endpoint types for in, out, and cmd endpoints, allowing mismatched endpoint types to reach usb_submit_urb() and trigger warnings or unexpected URB handling.

Why it matters to the business

Organizations running affected Linux kernels on systems with cxacru-based USB ADSL modems face potential device attachment failures, kernel warnings, or operational instability when connecting untrusted or malformed USB hardware; the issue remains unexploited in the wild with no ransomware use or CISA KEV listing despite high ecosystem prevalence of the Linux kernel.

How an attack unfolds

An attacker with physical or logical access to a USB port presents a crafted USB device that mimics a cxacru modem but supplies endpoint descriptors with incorrect types; during usb_probe and cxacru_bind the driver skips proper type checks, proceeds to cxacru_cm or card status operations that call usb_submit_urb with an invalid pipe, and triggers the kernel warning path.

How to fix it

Update the Linux kernel to the commit 5159a81924311c1ec786ad9fdef784ead8676a6a or later stable releases that include the endpoint type verification fix for both in and out endpoints while accounting for cmd endpoint type.

How to confirm the fix worked

Confirm the running kernel contains commit 5159a81924311c1ec786ad9fdef784ead8676a6a; test by attaching a cxacru-compatible device and verifying no BOGUS urb xfer warnings appear in dmesg during bind and card status operations.

Typical attack path

1. Attacker connects malicious or fuzzed USB device to a Linux host
2. Kernel USB core enumerates the device and calls cxacru_usb_probe
3. usbatm_usb_probe invokes cxacru_bind which performs incomplete endpoint validation
4. Driver proceeds to cxacru_card_status or cxacru_cm using wrong endpoint type
5. usb_submit_urb is called with mismatched pipe, generating kernel warning at urb.c:502

How to detect it

Search kernel logs and dmesg for usb_submit_urb warnings mentioning BOGUS urb xfer or pipe type mismatches originating from cxacru_cm or cxacru_bind call stacks; review USB device attachment events around the time of any such warnings.

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all systems that may attach cxacru USB devices
• Disable the cxacru driver module if the hardware is not required
• Monitor kernel logs for usb_submit_urb warnings related to pipe type mismatches
• Apply the update before any scheduled physical USB device testing or deployment