CVE-2024-45027

What it actually does

Null pointer dereference in xhci_mem_cleanup() when xhci->interrupters has not yet been allocated but xhci->max_interrupters is already set, triggered during early failure paths in xhci_mem_init().

Why it matters to the business

Systems may experience unexpected kernel crashes or instability during USB controller initialization under memory pressure or allocation failures, leading to downtime on servers and workstations using affected Linux kernels.

How an attack unfolds

An attacker with local access or the ability to induce DMA allocation failures can trigger the error path in xhci_mem_init(), causing the unconditional dereference in the cleanup routine and resulting in a kernel panic; no widespread exploitation observed.

How to fix it

Update the Linux kernel to a version containing commit 3efb29f6a78d4746f958c1ab6cd7981c5762f03b or later stable releases that gate the interrupt freeing loop on non-NULL xhci->interrupters.

How to confirm the fix worked

Verify the presence of the guarding check on xhci->interrupters in xhci_mem_cleanup() source or confirm kernel version includes the referenced commit; test USB initialization under simulated allocation failure conditions.

Typical attack path

1. Trigger early failure in xhci_mem_init() such as DMA allocation error
2. Reach xhci_mem_cleanup() before interrupters allocation
3. Unconditional dereference of xhci->interrupters causing crash

How to detect it

Inspect kernel logs and dmesg for oops or panic messages referencing xhci_mem_cleanup, xhci_mem_init, or interrupters dereference; correlate with USB initialization failures or DMA allocation errors.

• xhci_mem_cleanup
• xhci->interrupters
• max_interrupters
• xhci_mem_init

What your security team should do

• Apply the kernel fix containing commit 3efb29f6a78d4746f958c1ab6cd7981c5762f03b as soon as possible across all affected systems
• Monitor for kernel oops or panics involving xhci during boot or USB events
• Prioritize updates on systems with XHCI USB controllers exposed to untrusted hardware or memory-constrained environments