NULL pointer dereference in Linux
CVE-2024-36896
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in port.c:disable_store(): usb_hub_to_struct_hub() can return NULL if the hub that the port belongs to is concurrently removed, but the function does not check for this possibility before dereferencing the returned value. It turns out that the first dereference is unnecessary, since hub->intfdev is the parent of the port device, so it can be changed easily. Adding a check for hub == NULL prevents further problems. The same bug exists in the disable_show() routine, and it can be fixed the same way.
EPSS: 0.009 (56.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Linux — versions f061f43d7418cb62b8d073e221ec75d3f5b89e17, 6.0, 0
- Linux Linux_kernel — versions 6.9
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-36896?
- CVE-2024-36896 is a critical-severity vulnerability in Linux, classified under NULL Pointer Dereference. CVSS score: 9.1/10. Published 2024-05-30.
- How severe is CVE-2024-36896?
- Critical severity. CVSS v3 base score is 9.1 out of 10.