CVE-2024-26716

usb: core: Prevent null pointer dereference in update_port_device_state

published April 3, 2024

CVSS
—
EPSS
0%
Percentile
12.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: core: Prevent null pointer dereference in update_port_device_state

Currently, the function update_port_device_state gets the usb_hub from

udev->parent by calling usb_hub_to_struct_hub.

However, in case the actconfig or the maxchild is 0, the usb_hub would

be NULL and upon further accessing to get port_dev would result in null

pointer dereference.

Fix this by introducing an if check after the usb_hub is populated.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00227 · 12.7th percentile
Published
2024-04-03T14:55Z
EPSS history
Timeline
  • 03 APR 14:55Z
    usb: core: Prevent null pointer dereference in update_port_device_state
    cvelistv5