CVE-2024-46674

What it actually does

Incorrect reference count decrement on a bogus error path in the dwc3-st platform device probe handler causes unbalanced device refcounts, premature resource release, and use-after-free when devm-managed resources are later freed.

Why it matters to the business

Systems running affected Linux kernels may experience kernel crashes, memory corruption, or potential code execution during USB device enumeration or driver loading failures; urgency is low given no known exploitation and stable EPSS, but kernel stability in USB-heavy environments is at risk until patched.

How an attack unfolds

An attacker with local access or the ability to induce probe failures (for example by presenting malformed USB devices or triggering driver load errors) reaches the erroneous undo_platform_dev_alloc path, triggering the use-after-free when subsequent devm cleanup occurs; no public exploits or specific threat actor campaigns have been observed for this issue.

How to fix it

Update the Linux kernel to the fixed commit b0979a885b9d4df2a25b88e9d444ccaa5f9f495c or later stable releases containing the patch; rebuild and reboot affected systems; no configuration workarounds exist for the reference-counting flaw.

How to confirm the fix worked

Confirm the running kernel Git commit or version contains b0979a885b9d4df2a25b88e9d444ccaa5f9f495c; inspect the dwc3-st probe function for removal of the undo_platform_dev_alloc error label and its put_device call; test probe failure paths with fault-injection tools to verify no refcount imbalance occurs.

Typical attack path

1. Gain local execution or physical access to a system using the vulnerable dwc3-st driver
2. Trigger a probe error condition for the platform device (e.g., via USB hardware manipulation or driver reload failure)
3. Cause the kernel to execute the unbalanced put_device on the error path
4. Trigger subsequent devm resource release to dereference the now-freed device structure

How to detect it

Examine kernel logs for oops or panic messages referencing use-after-free in the dwc3 or platform device teardown paths; correlate with USB device attach/detach events or driver probe failures; no public indicators of active exploitation are known.

What your security team should do

• Prioritize kernel updates on systems exposing the dwc3-st USB controller within the next maintenance window
• Monitor upstream stable kernel releases for backports of the reference-count fix
• Review any custom USB device drivers or probe error handling that may interact with this path