Riskcovery

CVE-2024-26716

usb: core: Prevent null pointer dereference in update_port_device_state

State
Published
Severity
Not scored
Published
Apr 3, 2024
Updated
May 11, 2026
Reserved
Feb 19, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: core: Prevent null pointer dereference in update_port_device_state

Currently, the function update_port_device_state gets the usb_hub from udev->parent by calling usb_hub_to_struct_hub. However, in case the actconfig or the maxchild is 0, the usb_hub would be NULL and upon further accessing to get port_dev would result in null pointer dereference.

Fix this by introducing an if check after the usb_hub is populated.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 83cb2604f641cecadc275ca18adbba4bf262320f to before ed85777c640cf9e6920bb1b60ed8cd48e1f4d873Affected
  • 83cb2604f641cecadc275ca18adbba4bf262320f to before 465b545d1d7ef282192ddd4439b08279bdb13f6fAffected
  • 83cb2604f641cecadc275ca18adbba4bf262320f to before 12783c0b9e2c7915a50d5ec829630ff2da50472cAffected
LinuxLinux
  • 6.5Affected
  • before 6.5Not affected
  • 6.6.18 through 6.6.*Not affected
  • 6.7.6 through 6.7.*Not affected
  • 6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.