CVE-2024-50239

What it actually does

Missing driver data initialization in qmp-usb-legacy probe leads to NULL pointer dereference in runtime PM suspend callbacks.

Why it matters to the business

Kernel crashes or system instability on affected Linux devices with Qualcomm USB PHY hardware when runtime power management is manually enabled, potentially disrupting USB functionality and device operation.

How an attack unfolds

An attacker with local access enables runtime PM via sysfs then triggers suspend operations on the PHY driver to cause a NULL dereference crash; listed threat actors reference general Linux kernel resource and bounds issues but no targeted campaigns are known for this specific flaw.

How to fix it

Update the Linux kernel to a version containing commit 7e8066811a2c43fbb5f53c2c26d389e4bab9da34 or later stable releases that restore the driver data initialization at probe time.

How to confirm the fix worked

Verify the presence of the fix commit in the running kernel source, confirm driver data is initialized in probe, and test runtime suspend/resume without crashes.

Typical attack path

1. Gain local access to the system
2. Manually enable runtime PM for the qcom-qmp-usb-legacy driver through sysfs
3. Trigger runtime suspend on the USB PHY device
4. Cause NULL pointer dereference leading to kernel panic or oops

How to detect it

Review kernel logs for NULL pointer dereference oops messages referencing qmp-usb-legacy or runtime PM callbacks; check sysfs for enabled runtime PM on the driver.

• qmp-usb-legacy
• NULL pointer dereference
• runtime PM
• phy/qcom/qmp-usb-legacy

What your security team should do

• Prioritize kernel upgrades on systems using qcom-qmp-usb-legacy drivers
• Audit for manual runtime PM enablement via sysfs on affected hardware
• Monitor for kernel oops or panics involving the PHY driver
• Apply the patch or update to fixed versions listed in stable trees