CVE-2024-46719

What it actually does

Null pointer dereference occurs in trace code when ucsi_register_altmode receives NULL from ucsi_register_displayport (returned when CONFIG_TYPEC_DP_ALTMODE is disabled) instead of treating it as an error via IS_ERR.

Why it matters to the business

Kernel crash or denial of service on systems using USB Type-C with DisplayPort alternate mode support disabled at compile time; high prevalence in Linux distributions increases exposure across servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access triggers altmode registration paths that invoke ucsi_register_displayport under a disabled CONFIG_TYPEC_DP_ALTMODE build, causing the trace handler to dereference the NULL pointer returned instead of a valid or error pointer.

How to fix it

Update the Linux kernel to commit 8095bf0579ed4906a33f7bec675bfb29b6b16a3b or later stable releases containing the fix; rebuild with appropriate configuration or apply the patch that replaces the NULL return with typec_port_register_altmode for non-controllable DisplayPort mode.

How to confirm the fix worked

Verify the running kernel contains commit 8095bf0579ed4906a33f7bec675bfb29b6b16a3b, confirm CONFIG_TYPEC_DP_ALTMODE behavior no longer returns NULL from ucsi_register_displayport, and test altmode registration paths under disabled config.

Typical attack path

1. Compile or use a kernel without CONFIG_TYPEC_DP_ALTMODE enabled
2. Load or interact with USB Type-C UCSI driver triggering altmode registration
3. ucsi_register_displayport returns NULL
4. ucsi_register_altmode passes NULL to trace code without IS_ERR check
5. NULL dereference in trace handler causes kernel panic or oops

How to detect it

Review kernel logs for UCSI-related NULL pointer dereference oops or panic entries; inspect call traces involving ucsi_register_altmode and typec_port_register_altmode around USB device attach events.

What your security team should do

• Prioritize kernel updates to the fixed commit on all affected Linux systems within standard patch cycles
• Audit build configurations to ensure consistent handling of optional Type-C alternate modes
• Monitor for kernel oops or panic logs related to UCSI and Type-C drivers