Executive brief
A vulnerability in the Linux kernel's USB driver could allow a local user to crash the system. The issue occurs when certain USB commands are cancelled under specific timing conditions, leading to a system failure. This primarily impacts the availability of the system and any connected USB operations.
Technical details
A NULL pointer dereference exists in the xHCI driver (drivers/usb/host/xhci-ring.c) within the xhci_handle_stopped_cmd_ring() function. When a command is queued at the end of a ring segment and subsequently aborted, the dequeue pointer may advance to the next segment while the enqueue pointer remains at the link TRB. If no further commands are pending, the driver incorrectly assumes a command is active and attempts to modify a timer using a NULL command pointer (cur_cmd). This results in a kernel panic. The vulnerability can be triggered by local processes interacting with USB devices or by malicious USB hardware providing specific NAK responses. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 3.16 to 6.1.129, 6.2 to 6.6.76, 6.7 to 6.12.13, 6.13 to 6.13.2
Timeline
- 2024-12-27: patched: Initial patch authored by Michal Pecio
- 2025-02-27: disclosed: CVE-2024-57981 published
References
- https://git.kernel.org/stable/c/0ce5c0dac768be14afe2426101b568a0f66bfc4d
- https://git.kernel.org/stable/c/1e0a19912adb68a4b2b74fd77001c96cd83eb073
- https://git.kernel.org/stable/c/4ff18870af793ce2034a6ad746e91d0a3d985b88
- https://git.kernel.org/stable/c/ae069cd2ba09a2bd6a87a68c59ef0b7ea39cd641
- https://git.kernel.org/stable/c/b44253956407046e5907d4d72c8fa5b93ae94485
- https://git.kernel.org/stable/c/b649f0d5bc256f691c7d234c3986685d54053de1
- https://git.kernel.org/stable/c/cf30300a216a4f8dce94e11781a866a09d4b50d4