CVE-2024-26919

CVE-2024-26919

High · published April 17, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: ulpi: Fix debugfs directory leak

The ULPI per-device debugfs root is named after the ulpi device's

parent, but ulpi_unregister_interface tries to remove a debugfs

directory named after the ulpi device itself. This results in the

directory sticking around and preventing subsequent (deferred) probes

from succeeding. Change the directory name to match the ulpi device.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.4th percentile
Published
2024-04-17T20:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 5.18, < 6.1.796.1.79
linux/linux_kernel≥ 6.2, < 6.6.186.6.18
linux/linux_kernel≥ 6.7, < 6.7.66.7.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (8)
EPSS history
Timeline
  • 17 APR 15:59Z
    usb: ulpi: Fix debugfs directory leak
    cvelistv5