PT-2024-8921 · Linux+9 · Linux Kernel+9
Xingwei Lee
+1
·
Published
2024-04-23
·
Updated
2025-09-29
·
CVE-2024-36896
CVSS v2.0
9.4
Critical
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The issue is related to a bug in the Linux kernel's USB core, specifically in the
port.c file, where the disable store() function does not check if the hub that the port belongs to has been concurrently removed before dereferencing the returned value of usb hub to struct hub(). This can lead to a null pointer dereference. The same bug exists in the disable show() routine. The problem can be fixed by adding a check for hub == NULL.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu