CVE-2024-26715

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend

In current scenario if Plug-out and Plug-In performed continuously

there could be a chance while checking for dwc->gadget_driver in

dwc3_gadget_suspend, a NULL pointer dereference may occur.

Call Stack:

CPU1: CPU2:

gadget_unbind_driver dwc3_suspend_common

dwc3_gadget_stop dwc3_gadget_suspend

dwc3_disconnect_gadget

CPU1 basically clears the variable and CPU2 checks the variable.

Consider CPU1 is running and right before gadget_driver is cleared

and in parallel CPU2 executes dwc3_gadget_suspend where it finds

dwc->gadget_driver which is not NULL and resumes execution and then

CPU1 completes execution. CPU2 executes dwc3_disconnect_gadget where

it checks dwc->gadget_driver is already NULL because of which the

NULL pointer deference occur.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References