Vulnerability-Lookup

BDU:2026-09220 (CVE-2024-26919)

Vulnerability from fstec – Published: 2026-07-03 – Updated: 2026-07-03 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции ulpi_register() модуля drivers/usb/common/ulpi.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость функции ulpi_register() модуля drivers/usb/common/ulpi.c ядра операционной системы Linux связана с раскрытием конфиденциальной информации. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Severity

4.6 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:N/I:N/A:C

5.5 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Class

Multi-factor vulnerability

Status

Confirmed by the vendor

Exploitation

Information gathering, Authorization bypass

Incidents

Being clarified

Remediation

Software update

CWE

CWE-200 - Раскрытие информации
CWE-266 - Неправильное присваивание привилегий
CWE-284 - Неправильный контроль доступа

Aliases

CVE-2024-26919

References

20 references

URL
https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3
https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6
https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26919
https://lore.kernel.org/linux-cve-announce/2024041738-CVE-2024-26919-5100@gregkh/
https://www.cve.org/CVERecord?id=CVE-2024-26919
https://git.kernel.org/linus/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368
https://bugzilla.redhat.com/show_bug.cgi?id=2275777
https://ubuntu.com/security/notices/USN-6895-1
https://ubuntu.com/security/notices/USN-6895-2
https://ubuntu.com/security/notices/USN-6900-1
https://ubuntu.com/security/notices/USN-6895-3
https://ubuntu.com/security/notices/USN-6895-4
https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.79
https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.18
https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.6
https://ubuntu.com/security/CVE-2024-26919
https://security-tracker.debian.org/tracker/CVE-2024-26919
https://www.suse.com/security/cve/CVE-2024-26919.html
https://access.redhat.com/security/cve/cve-2024-26919

Impacted products

12 products from 5 vendors

Vendors

Novell Inc., Red Hat, Inc., Сообщество свободного программного обеспечения, Canonical Ltd.

Products

OpenSUSE Leap, Red Hat Enterprise Linux, Debian GNU/Linux, Ubuntu, SUSE Linux Enterprise Server for SAP Applications, Suse Linux Enterprise Server, Suse Linux Enterprise Desktop, SUSE Linux Enterprise Micro, openSUSE Leap Micro, SUSE Liberty Linux, Linux, SUSE Linux Micro

Versions

15.5 (OpenSUSE Leap), 8 (Red Hat Enterprise Linux), 12 (Debian GNU/Linux), 22.04 LTS (Ubuntu), 15 SP5 (SUSE Linux Enterprise Server for SAP Applications), 15 SP5 (Suse Linux Enterprise Server), 15 SP5 (Suse Linux Enterprise Desktop), 5.5 (SUSE Linux Enterprise Micro), 5.5 (openSUSE Leap Micro), 8 (SUSE Liberty Linux), от 6.2 до 6.6.17 включительно (Linux), 15 SP6 (Suse Linux Enterprise Desktop), от 6.7 до 6.7.5 включительно (Linux), 15 SP7 (Suse Linux Enterprise Desktop), 6.0 (SUSE Linux Micro), 6.1 (SUSE Linux Micro), 16.0 (Suse Linux Enterprise Server), от 5.18 до 6.1.78 включительно (Linux)

Product types

Operating system, Application software

Platforms

Novell Inc. OpenSUSE Leap 15.5, Red Hat, Inc. Red Hat Enterprise Linux 8, Сообщество свободного программного обеспечения Debian GNU/Linux 12, Canonical Ltd. Ubuntu 22.04 LTS, Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP5, Novell Inc. Suse Linux Enterprise Server 15 SP5, Novell Inc. Suse Linux Enterprise Desktop 15 SP5, Novell Inc. openSUSE Leap Micro 5.5, Novell Inc. SUSE Liberty Linux 8, Сообщество свободного программного обеспечения Linux от 6.2 до 6.6.17 включительно, Novell Inc. Suse Linux Enterprise Desktop 15 SP6, Сообщество свободного программного обеспечения Linux от 6.7 до 6.7.5 включительно, Novell Inc. Suse Linux Enterprise Desktop 15 SP7, Novell Inc. SUSE Linux Micro 6.0, Novell Inc. SUSE Linux Micro 6.1, Novell Inc. Suse Linux Enterprise Server 16.0, Сообщество свободного программного обеспечения Linux от 5.18 до 6.1.78 включительно

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Linux: https://lore.kernel.org/linux-cve-announce/2024041738-CVE-2024-26919-5100@gregkh/ https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3 https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6 https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b https://git.kernel.org/linus/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368 https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.79 https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.18 https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.6 Для программных продуктов Novell Inc.: https://www.suse.com/security/cve/CVE-2024-26919.html Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2024-26919 Для Ubuntu: https://ubuntu.com/security/CVE-2024-26919 Для продуктов Red Hat Inc.: https://access.redhat.com/security/cve/cve-2024-26919

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:N/I:N/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Novell Inc., Red Hat, Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, Canonical Ltd.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "15.5 (OpenSUSE Leap), 8 (Red Hat Enterprise Linux), 12 (Debian GNU/Linux), 22.04 LTS (Ubuntu), 15 SP5 (SUSE Linux Enterprise Server for SAP Applications), 15 SP5 (Suse Linux Enterprise Server), 15 SP5 (Suse Linux Enterprise Desktop), 5.5 (SUSE Linux Enterprise Micro), 5.5 (openSUSE Leap Micro), 8 (SUSE Liberty Linux), \u043e\u0442 6.2 \u0434\u043e 6.6.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), 15 SP6 (Suse Linux Enterprise Desktop), \u043e\u0442 6.7 \u0434\u043e 6.7.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), 15 SP7 (Suse Linux Enterprise Desktop), 6.0 (SUSE Linux Micro), 6.1 (SUSE Linux Micro), 16.0 (Suse Linux Enterprise Server), \u043e\u0442 5.18 \u0434\u043e 6.1.78 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\n\u0414\u043b\u044f Linux:\nhttps://lore.kernel.org/linux-cve-announce/2024041738-CVE-2024-26919-5100@gregkh/\nhttps://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3\nhttps://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6\nhttps://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b\nhttps://git.kernel.org/linus/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.79\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.18\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.6\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Novell Inc.:\nhttps://www.suse.com/security/cve/CVE-2024-26919.html\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2024-26919\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/CVE-2024-26919\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2024-26919",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "26.01.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "03.07.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "03.07.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-09220",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-26919",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043d\u043e\u0433\u043e\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "OpenSUSE Leap, Red Hat Enterprise Linux, Debian GNU/Linux, Ubuntu, SUSE Linux Enterprise Server for SAP Applications, Suse Linux Enterprise Server, Suse Linux Enterprise Desktop, SUSE Linux Enterprise Micro, openSUSE Leap Micro, SUSE Liberty Linux, Linux, SUSE Linux Micro",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Novell Inc. OpenSUSE Leap 15.5 , Red Hat, Inc. Red Hat Enterprise Linux 8 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , Canonical Ltd. Ubuntu 22.04 LTS , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP5 , Novell Inc. Suse Linux Enterprise Server 15 SP5 , Novell Inc. Suse Linux Enterprise Desktop 15 SP5 , Novell Inc. openSUSE Leap Micro 5.5 , Novell Inc. SUSE Liberty Linux 8 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.2 \u0434\u043e 6.6.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Novell Inc. Suse Linux Enterprise Desktop 15 SP6 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.7 \u0434\u043e 6.7.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Novell Inc. Suse Linux Enterprise Desktop 15 SP7 , Novell Inc. SUSE Linux Micro 6.0 , Novell Inc. SUSE Linux Micro 6.1 , Novell Inc. Suse Linux Enterprise Server 16.0 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.18 \u0434\u043e 6.1.78 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 ulpi_register() \u043c\u043e\u0434\u0443\u043b\u044f drivers/usb/common/ulpi.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (CWE-200), \u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0435 \u043f\u0440\u0438\u0441\u0432\u0430\u0438\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (CWE-266), \u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (CWE-284)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 ulpi_register() \u043c\u043e\u0434\u0443\u043b\u044f drivers/usb/common/ulpi.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3\nhttps://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6\nhttps://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26919\nhttps://lore.kernel.org/linux-cve-announce/2024041738-CVE-2024-26919-5100@gregkh/\nhttps://www.cve.org/CVERecord?id=CVE-2024-26919\nhttps://git.kernel.org/linus/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2275777\nhttps://ubuntu.com/security/notices/USN-6895-1\nhttps://ubuntu.com/security/notices/USN-6895-2\nhttps://ubuntu.com/security/notices/USN-6900-1\nhttps://ubuntu.com/security/notices/USN-6895-3\nhttps://ubuntu.com/security/notices/USN-6895-4\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.79\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.18\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.6\nhttps://ubuntu.com/security/CVE-2024-26919\nhttps://security-tracker.debian.org/tracker/CVE-2024-26919\nhttps://www.suse.com/security/cve/CVE-2024-26919.html\nhttps://access.redhat.com/security/cve/cve-2024-26919",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-200, CWE-266, CWE-284",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,6)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,5)"
}

CVE-2024-26919 (GCVE-0-2024-26919)

Vulnerability from cvelistv5 – Published: 2024-04-17 15:59 – Updated: 2026-08-05 11:28

Title

usb: ulpi: Fix debugfs directory leak

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: Fix debugfs directory leak The ULPI per-device debugfs root is named after the ulpi device's parent, but ulpi_unregister_interface tries to remove a debugfs directory named after the ulpi device itself. This results in the directory sticking around and preventing subsequent (deferred) probes from succeeding. Change the directory name to match the ulpi device.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-23 14:00 UTC

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/d31b886ed6a509521…
https://git.kernel.org/stable/c/330d22aba17a4d30a…
https://git.kernel.org/stable/c/33713945cc92ea9c4…
https://git.kernel.org/stable/c/3caf2b2ad7334ef35…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: bd0a0a024f2a41e7cc8eadb9862f82c45884b69c , < d31b886ed6a5095214062ee4fb55037eb930adb6 (git) Affected: bd0a0a024f2a41e7cc8eadb9862f82c45884b69c , < 330d22aba17a4d30a56f007d0f51291d7e00862b (git) Affected: bd0a0a024f2a41e7cc8eadb9862f82c45884b69c , < 33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3 (git) Affected: bd0a0a024f2a41e7cc8eadb9862f82c45884b69c , < 3caf2b2ad7334ef35f55b95f3e1b138c6f77b368 (git)
Linux	Linux	Affected: 5.18 Unaffected: 0 , < 5.18 (semver) Unaffected: 6.1.79 , ≤ 6.1.* (semver) Unaffected: 6.6.18 , ≤ 6.6.* (semver) Unaffected: 6.7.6 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26919",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-23T14:00:39.264752Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:38.512Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.553Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/common/ulpi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d31b886ed6a5095214062ee4fb55037eb930adb6",
              "status": "affected",
              "version": "bd0a0a024f2a41e7cc8eadb9862f82c45884b69c",
              "versionType": "git"
            },
            {
              "lessThan": "330d22aba17a4d30a56f007d0f51291d7e00862b",
              "status": "affected",
              "version": "bd0a0a024f2a41e7cc8eadb9862f82c45884b69c",
              "versionType": "git"
            },
            {
              "lessThan": "33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3",
              "status": "affected",
              "version": "bd0a0a024f2a41e7cc8eadb9862f82c45884b69c",
              "versionType": "git"
            },
            {
              "lessThan": "3caf2b2ad7334ef35f55b95f3e1b138c6f77b368",
              "status": "affected",
              "version": "bd0a0a024f2a41e7cc8eadb9862f82c45884b69c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/common/ulpi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.79",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: ulpi: Fix debugfs directory leak\n\nThe ULPI per-device debugfs root is named after the ulpi device\u0027s\nparent, but ulpi_unregister_interface tries to remove a debugfs\ndirectory named after the ulpi device itself. This results in the\ndirectory sticking around and preventing subsequent (deferred) probes\nfrom succeeding. Change the directory name to match the ulpi device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The use-after-free is triggered by a local read of `/sys/kernel/debug/ulpi/\u003cparent\u003e/regs`, a local filesystem operation on the affected host. No network protocol or physical device insertion is involved \u2014 the ULPI PHY is an on-board SoC component, not a hot-pluggable peripheral.\nAC:L - The stale debugfs entry is created deterministically by any deferred probe or driver unbind (`goto ulpi_exit` in `ci_hdrc_probe`), and every subsequent read reliably dereferences the freed `struct ulpi` and indirect-calls `ulpi-\u003eops-\u003eread`. The attacker fully controls when the read happens, so heap grooming between the `kfree()` and the read is entirely within their control \u2014 no condition depends on external state.\nPR:L - The kernel itself publishes the leaked directory as 0755 and the `regs` file as 0444, so any local user who can traverse the debugfs mount can trigger the UAF; on the ULPI-bearing platforms that matter (Android handsets, automotive/industrial chipidea and dwc3 boards) debugfs is commonly mounted with relaxed mode or group access for diagnostics daemons. No capability, namespace privilege, or kernel-enforced access check guards the vulnerable file.\nUI:N - The attacker performs the read themselves; no victim action is required. The dangling pointer arises automatically from normal deferred-probe behavior at boot.\nS:U - The freed object, the corrupted heap, and the hijackable indirect call all live within the kernel\u0027s own security authority. There is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a use-after-free on a ~1KB slab object; reclaiming the freed `struct ulpi` with attacker-shaped data and reading `regs` turns `ulpi-\u003eops-\u003eread` into a controlled call, which is a general kernel-memory disclosure primitive. Even without grooming, the file dumps values derived from freed kernel heap contents.\nI:H - `ulpi_read()` loads a function pointer out of freed memory and indirect-calls it (21 times per read of `regs`), giving direct control-flow hijack once the slab slot is reclaimed \u2014 a full arbitrary-write/code-execution primitive, not just corruption.\nA:H - Dereferencing the freed `struct ulpi` and calling through a garbage `ops` pointer oopses or panics the kernel, and the stale entry can be read repeatedly. Per kernel scoring guidance any use-after-free is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:18.079Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b"
        },
        {
          "url": "https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368"
        }
      ],
      "title": "usb: ulpi: Fix debugfs directory leak",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26919",
    "datePublished": "2024-04-17T15:59:27.581Z",
    "dateReserved": "2024-02-19T14:20:24.193Z",
    "dateUpdated": "2026-08-05T11:28:18.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2026-09220 (CVE-2024-26919)

CVE-2024-26919 (GCVE-0-2024-26919)

Tags

Sightings

Nomenclature

Related by attack behaviour