CVE-2024-50100

What it actually does

Race condition in dummy-hcd USB gadget driver caused by replacing timer_pending() with hrtimer_active(); the latter returns true while the callback runs, allowing dummy_urb_enqueue() to skip restarting the hrtimer and leaving a URB permanently enqueued so that usb_kill_urb() hangs.

Why it matters to the business

Systems may experience unrecoverable task hangs during USB gadget testing or enumeration, leading to service disruption, forced reboots, and delayed development or validation workflows.

How an attack unfolds

An attacker with local access or the ability to trigger USB gadget operations repeatedly enqueues and kills URBs in a narrow timing window; the flawed hrtimer check prevents timer restart, the URB cannot be dequeued, and usb_kill_urb() blocks indefinitely, escalating to system-wide task-hung conditions.

How to fix it

Apply the upstream patch that introduces an explicit timer_pending flag set and cleared around hrtimer operations; update to a kernel containing the fix for CVE-2024-50100.

How to confirm the fix worked

Confirm the presence of the timer_pending flag logic in drivers/usb/gadget/udc/dummy_hcd.c and verify that usb_kill_urb no longer hangs under the previously problematic enqueue/kill sequences.

Typical attack path

1. Obtain ability to interact with dummy-hcd (local user, test harness, or container)
2. Issue rapid URB enqueue/dequeue sequences via gadget driver
3. Time operations so hrtimer callback is running when enqueue checks status
4. Prevent timer restart and block subsequent usb_kill_urb calls
5. Trigger kernel task-hung detection or resource exhaustion

How to detect it

Review kernel logs for task-hung messages referencing dummy_hcd, usb_kill_urb, or hrtimer; inspect call traces showing URB enqueue without corresponding dequeue completion.

What your security team should do

• Prioritize kernel updates on any systems exposing USB gadget functionality
• Monitor for task-hung reports involving dummy-hcd or usb_kill_urb
• Restrict unprivileged access to USB gadget interfaces until patched