PT-2024-4114 · Linux+10 · Linux Kernel+10
Alan Stern
·
Published
2024-03-26
·
Updated
2025-10-20
·
CVE-2024-26933
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to a deadlock in the port "disable" sysfs attribute in the Linux kernel's USB core. The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device, which can cause problems if another process has locked the hub to remove it or change its configuration. This can lead to a deadlock situation where the lock cannot be released until the callback routines return, but the callback routines cannot return until after they have acquired the lock. The deadlock can be avoided by calling sysfs break active protection(), but this call has the disadvantage that there is no guarantee that the hub structure won't be deallocated at any moment. To prevent this, a reference to the hub structure must be acquired first by calling hub get().
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu