CVE-2024-45006

What it actually does

NULL pointer dereference in xhci_reserve_bandwidth during full-speed USB device re-enumeration after a failed address device command on Panther Point xHC controllers, because bandwidth table pointers are not initialized when a new xhci_virt_device is allocated.

Why it matters to the business

Local or physical attacker with USB access can crash affected Linux systems, causing denial of service and potential loss of availability for servers, desktops, or embedded devices that rely on the kernel USB stack.

How an attack unfolds

An attacker connects a full-speed USB device that deliberately fails the address device command during enumeration; the kernel then attempts re-enumeration, calls usb_ep0_reinit which invokes xhci_configure_endpoint, and the missing bandwidth pointers trigger the NULL dereference.

How to fix it

Upgrade the Linux kernel to a version containing commit ef0a0e616b2789bb804a0ce5e161db03170a85b6 or later stable releases that ensure bandwidth table pointers are set after a failed address device command and skip unnecessary bandwidth checks for endpoint-0-only changes.

How to confirm the fix worked

Verify the running kernel contains the fix commit, reproduce enumeration of a full-speed device that previously failed address assignment, and confirm absence of NULL pointer oops in dmesg; monitor for the specific RIP in xhci_reserve_bandwidth.

Typical attack path

1. Physically or via USB passthrough attach a full-speed device that rejects address assignment
2. Kernel logs repeated device-not-accepting-address errors and initiates re-enumeration
3. usb_hub_wq triggers xhci_configure_endpoint for endpoint 0 only
4. Uninitialized bandwidth table causes kernel NULL pointer dereference and oops

How to detect it

Search kernel logs for oops messages containing xhci_reserve_bandwidth, NULL pointer dereference at address 0000000000000008, and preceding USB address assignment failures; correlate with usb_hub_wq and kworker processes handling hub events.

• BUG: kernel NULL pointer dereference, address: 0000000000000008
• xhci_reserve_bandwidth
• usb 3-1: device not accepting address
• Workqueue: usb_hub_wq hub_event
• RIP: 0010:xhci_reserve_bandwidth

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all systems exposing USB to untrusted devices
• Restrict physical USB ports or use USBGuard / kernel USB authorization to limit device classes until patched
• Add kernel oops and xhci error patterns to SIEM alerting for rapid detection of attempted exploitation