Executive brief
A vulnerability in the Linux kernel's Renesas USB3.0 driver could allow a local attacker to crash the system. The issue occurs when the system processes specific USB requests without properly checking if the requested communication channel (endpoint) actually exists. This can lead to a system failure, impacting the availability of devices using this specific hardware controller.
Technical details
A NULL pointer dereference vulnerability exists in the renesas_usb3 driver within the Linux kernel's USB gadget subsystem. The GET_STATUS and SET/CLEAR_FEATURE standard request handlers extract an endpoint number from the host-supplied wIndex field without validation. If an attacker provides an out-of-bounds endpoint index, the driver attempts to dereference a pointer based on that index, leading to a kernel oops or crash. This issue affects systems using Renesas USB3.0 peripheral controllers. Patches have been released across multiple stable kernel branches to validate the endpoint index against the device's actual number of endpoints.
Affected products
- Linux Linux Kernel 4.5 to 6.6.136, 6.12 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-06: patched: Initial patch authored by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/1b2bfedccc4fb8c9572e1ea464f905424c91de2a
- https://git.kernel.org/stable/c/360aa6e71870a175a6d86af905be2ca171639eb3
- https://git.kernel.org/stable/c/37f430b2240655e6b0199a92aa1057e4d621be51
- https://git.kernel.org/stable/c/44216e3dd4455b798899b50eedb0ec3831dff8e0
- https://git.kernel.org/stable/c/7caaf76207f50c77abfd788380e19b2c23a94415
- https://git.kernel.org/stable/c/adb8014599fdf0818d3d93f1f74e06cd0bdec08d
- https://git.kernel.org/stable/c/c4e5ae6db2328d2d9ed55d3005a36c13faab0752