We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Bugpilot (Bug tracking)

Ok

THREATINT CVE Home CVE Diag Help
PUBLISHED

CVE-2024-26716

usb: core: Prevent null pointer dereference in update_port_device_state

Reserved:2024-02-19
Published:2024-04-03
Updated:2024-04-03

Description

In the Linux kernel, the following vulnerability has been resolved: usb: core: Prevent null pointer dereference in update_port_device_state Currently, the function update_port_device_state gets the usb_hub from udev->parent by calling usb_hub_to_struct_hub. However, in case the actconfig or the maxchild is 0, the usb_hub would be NULL and upon further accessing to get port_dev would result in null pointer dereference. Fix this by introducing an if check after the usb_hub is populated.

Product status

Default status
unaffected

83cb2604f641 before ed85777c640c
affected

83cb2604f641 before 465b545d1d7e
affected

83cb2604f641 before 12783c0b9e2c
affected

Default status
affected

6.5
affected

Any version before 6.5
unaffected

6.6.18
unaffected

6.7.6
unaffected

6.8
unaffected

References

https://git.kernel.org/stable/c/ed85777c640cf9e6920bb1b60ed8cd48e1f4d873

https://git.kernel.org/stable/c/465b545d1d7ef282192ddd4439b08279bdb13f6f

https://git.kernel.org/stable/c/12783c0b9e2c7915a50d5ec829630ff2da50472c

cve.org CVE-2024-26716

nvd.nist.gov CVE-2024-26716

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-26716