Riskcovery

CVE-2024-56698

usb: dwc3: gadget: Fix looping of queued SG entries

State
Published
Severity
5.5 Medium
Published
Dec 28, 2024
Updated
May 11, 2026
Reserved
Dec 27, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: Fix looping of queued SG entries

The dwc3_request->num_queued_sgs is decremented on completion. If a partially completed request is handled, then the dwc3_request->num_queued_sgs no longer reflects the total number of num_queued_sgs (it would be cleared).

Correctly check the number of request SG entries remained to be prepare and queued. Failure to do this may cause null pointer dereference when accessing non-existent SG entry.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • c96e6725db9d6a04ac1bee881e3034b636d9f71c to before 8ceb21d76426bbe7072cc3e43281e70c0d664cc7Affected
  • c96e6725db9d6a04ac1bee881e3034b636d9f71c to before 0247da93bf62d33304b7bf97850ebf2a86e06d28Affected
  • c96e6725db9d6a04ac1bee881e3034b636d9f71c to before c9e72352a10ae89a430449f7bfeb043e75c255d9Affected
  • c96e6725db9d6a04ac1bee881e3034b636d9f71c to before 1534f6f69393aac773465d80d31801b554352627Affected
  • c96e6725db9d6a04ac1bee881e3034b636d9f71c to before b7c3d0b59213ebeedff63d128728ce0b3d7a51ecAffected
  • c96e6725db9d6a04ac1bee881e3034b636d9f71c to before 70777a23a54e359cfdfafc625a57cd56434f3859Affected
  • c96e6725db9d6a04ac1bee881e3034b636d9f71c to before b7fc65f5141c24785dc8c19249ca4efcf71b3524Affected
LinuxLinux
  • 4.18Affected
  • before 4.18Not affected
  • 5.10.231 through 5.10.*Not affected
  • 5.15.174 through 5.15.*Not affected
  • 6.1.120 through 6.1.*Not affected
  • 6.6.64 through 6.6.*Not affected
  • 6.11.11 through 6.11.*Not affected
  • 6.12.2 through 6.12.*Not affected
  • 6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.