CVE-2024-57981

What it actually does

NULL pointer dereference in xhci_handle_stopped_cmd_ring when cur_cmd is NULL after advancing dequeue pointer past a link TRB on command abort, causing kernel crash on timer setup.

Why it matters to the business

Unexpected system crashes and denial of service on Linux hosts with USB devices, increasing downtime and operational disruption especially in environments with frequent USB activity or 98 downstream dependents.

How an attack unfolds

Attacker with local access triggers the race by queuing a command to the final TRB of a ring segment, aborts it, and ensures no further commands are queued so the stopped command ring handler dereferences NULL when attempting to set the command timer; similar patterns seen in other Linux kernel privilege escalation campaigns.

How to fix it

Apply kernel patch that adds NULL check for cur_cmd before calling xhci_mod_cmd_timer; upgrade affected packages to fixed versions such as tensorflow 2.7.2 where applicable and rebuild with updated kernel sources.

How to confirm the fix worked

Confirm patch by inspecting xhci.c for cur_cmd NULL guard, verify kernel version post-update, and reproduce with USB MCU that NAKs SET_ADDRESS status stage to ensure no crash occurs.

Typical attack path

1. Obtain local access on affected Linux system
2. Attach or emulate USB device that can force command aborts
3. Queue command to final usable TRB of ring segment
4. Abort the command and avoid queuing further commands
5. Trigger xhci_handle_stopped_cmd_ring with cur_cmd NULL to crash kernel

How to detect it

Search kernel logs and dmesg for NULL pointer dereference traces mentioning xhci_handle_stopped_cmd_ring or cur_cmd; correlate with USB device attach events and command abort completions.

• xhci_handle_stopped_cmd_ring
• cur_cmd was NULL
• NULL pointer dereference in xhci
• usb: xhci: Fix NULL pointer dereference on certain command aborts

What your security team should do

• Prioritize kernel updates on all Linux systems with USB support due to 608 days since publication and rising EPSS trend
• Monitor USB command ring handling code paths in production kernels
• Restrict local USB device access where feasible until patched
• Test patches in staging environments using command abort reproduction cases