VYPR
Medium severity5.5NVD Advisory· Published Apr 3, 2024· Updated Jun 17, 2026

CVE-2024-26716

CVE-2024-26716

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: core: Prevent null pointer dereference in update_port_device_state

Currently, the function update_port_device_state gets the usb_hub from udev->parent by calling usb_hub_to_struct_hub. However, in case the actconfig or the maxchild is 0, the usb_hub would be NULL and upon further accessing to get port_dev would result in null pointer dereference.

Fix this by introducing an if check after the usb_hub is populated.

Affected products

6
  • Linux/Kernelllm-fuzzy5 versions
    (expand)+ 4 more
    • (no CPE)
    • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.5,<6.6.18
    • cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
    • (no CPE)range: 6.5
  • osv-coords
    Range: >= 6.5.0, < 6.6.18

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.