CVE-2024-26747

usb: roles: fix NULL pointer issue when put module's reference

State: Published
Severity: 4.4 Medium
Published: Apr 3, 2024
Updated: May 23, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: roles: fix NULL pointer issue when put module's reference

In current design, usb role class driver will get usb_role_switch parent's module reference after the user get usb_role_switch device and put the reference after the user put the usb_role_switch device. However, the parent device of usb_role_switch may be removed before the user put the usb_role_switch. If so, then, NULL pointer issue will be met when the user put the parent module's reference.

This will save the module pointer in structure of usb_role_switch. Then, we don't need to find module by iterating long relations.

Scores

CVSS	Score	Vector	Source
3.1	4.4 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before e279bf8e51893e1fe160b3d8126ef2dd00f661e1Affected 5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before ef982fc41055fcebb361a92288d3225783d12913Affected 5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before 0158216805ca7e498d07de38840d2732166ae5faAffected 5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before 4b45829440b1b208948b39cc71f77a37a2536734Affected 5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before 01f82de440f2ab07c259b7573371e1c42e5565dbAffected 5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before 1c9be13846c0b2abc2480602f8ef421360e1ad9eAffected 7b169e33a3bc9040e06988b2bc15e83d2af80358Affected 4.18.12 to before 4.19Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.10.211 through 5.10.Not affected 5.15.150 through 5.15.Not affected 6.1.80 through 6.1.Not affected 6.6.19 through 6.6.Not affected 6.7.7 through 6.7.*Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before e279bf8e51893e1fe160b3d8126ef2dd00f661e1Affected
5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before ef982fc41055fcebb361a92288d3225783d12913Affected
5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before 0158216805ca7e498d07de38840d2732166ae5faAffected
5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before 4b45829440b1b208948b39cc71f77a37a2536734Affected
5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before 01f82de440f2ab07c259b7573371e1c42e5565dbAffected
5c54fcac9a9de559b444ac63ec3cd82f1d157a0b to before 1c9be13846c0b2abc2480602f8ef421360e1ad9eAffected
7b169e33a3bc9040e06988b2bc15e83d2af80358Affected
4.18.12 to before 4.19Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.10.211 through 5.10.*Not affected
5.15.150 through 5.15.*Not affected
6.1.80 through 6.1.*Not affected
6.6.19 through 6.6.*Not affected
6.7.7 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.