VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Mar 27, 2024· Updated May 12, 2026

CVE-2024-26651

CVE-2024-26651

Description

In the Linux kernel, the following vulnerability has been resolved:

sr9800: Add check for usbnet_get_endpoints

Add check for usbnet_get_endpoints() and return the error if it fails in order to transfer the error.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing error check in the Linux kernel's sr9800 USB Ethernet driver could lead to a NULL pointer dereference and system crash.

Vulnerability

Overview

The Linux kernel's sr9800 driver, which provides support for USB Ethernet adapters based on the SR9800 chipset, contains a missing error check. Specifically, the function usbnet_get_endpoints() is called without verifying its return value. If this function fails, the driver continues initialization without properly allocated endpoints, leading to a NULL pointer dereference when the device is subsequently used [1].

Exploitation

Details

To exploit this vulnerability, an attacker would need to insert a malicious or malfunctioning USB device that triggers a failure in usbnet_get_endpoints(). No authentication is required, as the attack can be performed by an unprivileged user with physical access to a USB port. The issue manifests during the device enumeration and driver binding process, where the kernel fails to handle the error condition gracefully [2][4].

Impact

If exploited, this vulnerability results in a NULL pointer dereference in the kernel, causing a system crash or denial-of-service condition. The CVSS score of 5.5 (Medium) reflects the requirement for physical access and the availability impact. There is no indication of potential privilege escalation or data leakage beyond a system crash [1].

Mitigation

Status

The vulnerability was fixed in the Linux kernel by adding a proper check for the return value of usbnet_get_endpoints(). The fix has been backported to stable kernel versions. Users should update their kernel to incorporate this change. Affected products, such as Siemens SIMATIC S7-1500 TM MFP, list this CVE, emphasizing the importance of applying updates in industrial control system environments [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

69

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

14

News mentions

0

No linked articles in our index yet.