CVE-2024-40927

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xhci: Handle TD clearing for multiple streams case

When multiple streams are in use, multiple TDs might be in flight when

an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for

each, to ensure everything is reset properly and the caches cleared.

Change the logic so that any N>1 TDs found active for different streams

are deferred until after the first one is processed, calling

xhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to

queue another command until we are done with all of them. Also change

the error/"should never happen" paths to ensure we at least clear any

affected TDs, even if we can't issue a command to clear the hardware

cache, and complain loudly with an xhci_warn() if this ever happens.

This problem case dates back to commit e9df17eb1408 ("USB: xhci: Correct

assumptions about number of rings per endpoint.") early on in the XHCI

driver's life, when stream support was fi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References