CVE-2024-26748 (GCVE-0-2024-26748)

Vulnerability from cvelistv5 – Published: 2024-04-03 17:00 – Updated: 2026-08-05 11:26
VLAI
Title
usb: cdns3: fix memory double free when handle zero packet
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix memory double free when handle zero packet 829 if (request->complete) { 830 spin_unlock(&priv_dev->lock); 831 usb_gadget_giveback_request(&priv_ep->endpoint, 832 request); 833 spin_lock(&priv_dev->lock); 834 } 835 836 if (request->buf == priv_dev->zlp_buf) 837 cdns3_gadget_ep_free_request(&priv_ep->endpoint, request); Driver append an additional zero packet request when queue a packet, which length mod max packet size is 0. When transfer complete, run to line 831, usb_gadget_giveback_request() will free this requestion. 836 condition is true, so cdns3_gadget_ep_free_request() free this request again. Log: [ 1920.140696][ T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.140696][ T150] [ 1920.151837][ T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36): [ 1920.159082][ T150] cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.164988][ T150] cdns3_transfer_completed+0x438/0x5f8 [cdns3] Add check at line 829, skip call usb_gadget_giveback_request() if it is additional zero length packet request. Needn't call usb_gadget_giveback_request() because it is allocated in this driver.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7733f6c32e36ff9d7adadf40001039bf219b1cbe , < aad6132ae6e4809e375431f8defd1521985e44e7 (git)
Affected: 7733f6c32e36ff9d7adadf40001039bf219b1cbe , < 1e204a8e9eb514e22a6567fb340ebb47df3f3a48 (git)
Affected: 7733f6c32e36ff9d7adadf40001039bf219b1cbe , < 3a2a909942b5335b7ea66366d84261b3ed5f89c8 (git)
Affected: 7733f6c32e36ff9d7adadf40001039bf219b1cbe , < 9a52b694b066f299d8b9800854a8503457a8b64c (git)
Affected: 7733f6c32e36ff9d7adadf40001039bf219b1cbe , < 70e8038813f9d3e72df966748ebbc40efe466019 (git)
Affected: 7733f6c32e36ff9d7adadf40001039bf219b1cbe , < 92d20406a3d4ff3e8be667c79209dc9ed31df5b3 (git)
Affected: 7733f6c32e36ff9d7adadf40001039bf219b1cbe , < 5fd9e45f1ebcd57181358af28506e8a661a260b3 (git)
Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 5.4.270 , ≤ 5.4.* (semver)
Unaffected: 5.10.211 , ≤ 5.10.* (semver)
Unaffected: 5.15.150 , ≤ 5.15.* (semver)
Unaffected: 6.1.80 , ≤ 6.1.* (semver)
Unaffected: 6.6.19 , ≤ 6.6.* (semver)
Unaffected: 6.7.7 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26748",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-05T17:31:00.230088Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:02.965Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.207Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aad6132ae6e4809e375431f8defd1521985e44e7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1e204a8e9eb514e22a6567fb340ebb47df3f3a48"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3a2a909942b5335b7ea66366d84261b3ed5f89c8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9a52b694b066f299d8b9800854a8503457a8b64c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/70e8038813f9d3e72df966748ebbc40efe466019"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/92d20406a3d4ff3e8be667c79209dc9ed31df5b3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5fd9e45f1ebcd57181358af28506e8a661a260b3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/cdns3/cdns3-gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aad6132ae6e4809e375431f8defd1521985e44e7",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            },
            {
              "lessThan": "1e204a8e9eb514e22a6567fb340ebb47df3f3a48",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            },
            {
              "lessThan": "3a2a909942b5335b7ea66366d84261b3ed5f89c8",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            },
            {
              "lessThan": "9a52b694b066f299d8b9800854a8503457a8b64c",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            },
            {
              "lessThan": "70e8038813f9d3e72df966748ebbc40efe466019",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            },
            {
              "lessThan": "92d20406a3d4ff3e8be667c79209dc9ed31df5b3",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            },
            {
              "lessThan": "5fd9e45f1ebcd57181358af28506e8a661a260b3",
              "status": "affected",
              "version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/cdns3/cdns3-gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.270",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.211",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.150",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.80",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fix memory double free when handle zero packet\n\n829  if (request-\u003ecomplete) {\n830          spin_unlock(\u0026priv_dev-\u003elock);\n831          usb_gadget_giveback_request(\u0026priv_ep-\u003eendpoint,\n832                                    request);\n833          spin_lock(\u0026priv_dev-\u003elock);\n834  }\n835\n836  if (request-\u003ebuf == priv_dev-\u003ezlp_buf)\n837      cdns3_gadget_ep_free_request(\u0026priv_ep-\u003eendpoint, request);\n\nDriver append an additional zero packet request when queue a packet, which\nlength mod max packet size is 0. When transfer complete, run to line 831,\nusb_gadget_giveback_request() will free this requestion. 836 condition is\ntrue, so cdns3_gadget_ep_free_request() free this request again.\n\nLog:\n\n[ 1920.140696][  T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\n[ 1920.140696][  T150]\n[ 1920.151837][  T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36):\n[ 1920.159082][  T150]  cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\n[ 1920.164988][  T150]  cdns3_transfer_completed+0x438/0x5f8 [cdns3]\n\nAdd check at line 829, skip call usb_gadget_giveback_request() if it is\nadditional zero length packet request. Needn\u0027t call\nusb_gadget_giveback_request() because it is allocated in this driver."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is selected entirely by locally queued transfer parameters (`req-\u003ezero` plus `length % maxpacket == 0`) set by in-kernel function drivers on behalf of local userspace \u2014 USB-Ethernet/NCM tethering, the printer gadget, UVC streaming \u2014 not by anything a USB peer supplies, so no physical action by the attacker is needed on a peripheral in its normal connected operating state. This matches the AV:L treatment of the sibling cdns3 gadget flaw CVE-2024-26747.\nAC:L - The attacker fully controls the transfer length, and the ZLP request append plus the buggy giveback sequence follow deterministically; the lock-drop window around `usb_gadget_giveback_request()` is one the attacker widens at will by queuing transfers concurrently from multiple threads.\nPR:L - Once the gadget is configured (normal system state on these embedded boards), any unprivileged process can drive the path \u2014 e.g. sending a UDP datagram sized so the NCM/ECM frame is an exact multiple of the 512/1024-byte bulk-IN maxpacket over `usb0`, or writing to `/dev/g_printer0` or the UVC gadget node \u2014 with no capability check anywhere on the path.\nUI:N - No victim action is required; the affected devices operate as USB peripherals attached to a host as their normal deployed state, and the attacker triggers the flaw purely by generating traffic.\nS:U - The corruption is confined to kernel heap memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The flaw includes a confirmed use-after-free read of a freed `struct cdns3_request` (KFENCE-reported), and the double free of a kmalloc-192 general-cache object lets an attacker reallocate it with sprayed data and have the driver disclose or act on it, enabling arbitrary kernel memory disclosure.\nI:H - Freeing a still-live request returns an in-use object to the general slab allocator while the driver continues writing into it (`request-\u003eactual`, `finished_trb`, TRB pointers, list linkage), a classic double-free/UAF write primitive leveragable for control-flow hijack and privilege escalation.\nA:H - The double free corrupts slab freelists and the endpoint request lists, reliably producing kernel oops/panic, and it can be re-triggered at will by an unprivileged local process."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:59.831Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aad6132ae6e4809e375431f8defd1521985e44e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e204a8e9eb514e22a6567fb340ebb47df3f3a48"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a2a909942b5335b7ea66366d84261b3ed5f89c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a52b694b066f299d8b9800854a8503457a8b64c"
        },
        {
          "url": "https://git.kernel.org/stable/c/70e8038813f9d3e72df966748ebbc40efe466019"
        },
        {
          "url": "https://git.kernel.org/stable/c/92d20406a3d4ff3e8be667c79209dc9ed31df5b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fd9e45f1ebcd57181358af28506e8a661a260b3"
        }
      ],
      "title": "usb: cdns3: fix memory double free when handle zero packet",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26748",
    "datePublished": "2024-04-03T17:00:35.087Z",
    "dateReserved": "2024-02-19T14:20:24.168Z",
    "dateUpdated": "2026-08-05T11:26:59.831Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26748",
      "date": "2026-08-05",
      "epss": "0.00242",
      "percentile": "0.15423"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: cdns3: fix memory double free when handle zero packet\\n\\n829  if (request-\u003ecomplete) {\\n830          spin_unlock(\u0026priv_dev-\u003elock);\\n831          usb_gadget_giveback_request(\u0026priv_ep-\u003eendpoint,\\n832                                    request);\\n833          spin_lock(\u0026priv_dev-\u003elock);\\n834  }\\n835\\n836  if (request-\u003ebuf == priv_dev-\u003ezlp_buf)\\n837      cdns3_gadget_ep_free_request(\u0026priv_ep-\u003eendpoint, request);\\n\\nDriver append an additional zero packet request when queue a packet, which\\nlength mod max packet size is 0. When transfer complete, run to line 831,\\nusb_gadget_giveback_request() will free this requestion. 836 condition is\\ntrue, so cdns3_gadget_ep_free_request() free this request again.\\n\\nLog:\\n\\n[ 1920.140696][  T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\\n[ 1920.140696][  T150]\\n[ 1920.151837][  T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36):\\n[ 1920.159082][  T150]  cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\\n[ 1920.164988][  T150]  cdns3_transfer_completed+0x438/0x5f8 [cdns3]\\n\\nAdd check at line 829, skip call usb_gadget_giveback_request() if it is\\nadditional zero length packet request. Needn\u0027t call\\nusb_gadget_giveback_request() because it is allocated in this driver.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: cdns3: corrige la memoria doblemente libre cuando se maneja el paquete cero 829 if (request-\u0026gt;complete) { 830 spin_unlock(\u0026amp;priv_dev-\u0026gt;lock); 831 usb_gadget_giveback_request(\u0026amp;priv_ep-\u0026gt;endpoint, solicitud 832); 833 spin_lock(\u0026amp;priv_dev-\u0026gt;lock); 834 } 835 836 if (solicitud-\u0026gt;buf == priv_dev-\u0026gt;zlp_buf) 837 cdns3_gadget_ep_free_request(\u0026amp;priv_ep-\u0026gt;endpoint, solicitud); El controlador agrega una solicitud de paquete cero adicional cuando pone en cola un paquete, cuya longitud mod tama\\u00f1o m\\u00e1ximo del paquete es 0. Cuando se complete la transferencia, ejecute la l\\u00ednea 831, usb_gadget_giveback_request() liberar\\u00e1 esta solicitud. La condici\\u00f3n 836 es verdadera, por lo que cdns3_gadget_ep_free_request() libera esta solicitud nuevamente. Registro: [1920.140696][ T150] ERROR: KFENCE: lectura de uso despu\\u00e9s de liberaci\\u00f3n en cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.140696][ T150] [ 1920.151837][ T150] Lectura de uso despu\\u00e9s de liberaci\\u00f3n en 0x000000003d 1cd10b (en kcerca -#36): [ 1920.159082][ T150] cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.164988][ T150] cdns3_transfer_completed+0x438/0x5f8 [cdns3] Agregar cheque en la l\\u00ednea 829, omitir llamada usb_gadget_giveback_ request() si tiene una longitud cero adicional solicitud de paquete. No es necesario llamar a usb_gadget_giveback_request() porque est\\u00e1 asignado en este controlador.\"}]",
      "id": "CVE-2024-26748",
      "lastModified": "2024-11-21T09:02:58.950",
      "published": "2024-04-03T17:15:51.727",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1e204a8e9eb514e22a6567fb340ebb47df3f3a48\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3a2a909942b5335b7ea66366d84261b3ed5f89c8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5fd9e45f1ebcd57181358af28506e8a661a260b3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/70e8038813f9d3e72df966748ebbc40efe466019\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/92d20406a3d4ff3e8be667c79209dc9ed31df5b3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9a52b694b066f299d8b9800854a8503457a8b64c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/aad6132ae6e4809e375431f8defd1521985e44e7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1e204a8e9eb514e22a6567fb340ebb47df3f3a48\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/3a2a909942b5335b7ea66366d84261b3ed5f89c8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/5fd9e45f1ebcd57181358af28506e8a661a260b3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/70e8038813f9d3e72df966748ebbc40efe466019\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/92d20406a3d4ff3e8be667c79209dc9ed31df5b3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9a52b694b066f299d8b9800854a8503457a8b64c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/aad6132ae6e4809e375431f8defd1521985e44e7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Undergoing Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26748\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T17:15:51.727\",\"lastModified\":\"2026-08-04T11:17:00.640\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: cdns3: fix memory double free when handle zero packet\\n\\n829  if (request-\u003ecomplete) {\\n830          spin_unlock(\u0026priv_dev-\u003elock);\\n831          usb_gadget_giveback_request(\u0026priv_ep-\u003eendpoint,\\n832                                    request);\\n833          spin_lock(\u0026priv_dev-\u003elock);\\n834  }\\n835\\n836  if (request-\u003ebuf == priv_dev-\u003ezlp_buf)\\n837      cdns3_gadget_ep_free_request(\u0026priv_ep-\u003eendpoint, request);\\n\\nDriver append an additional zero packet request when queue a packet, which\\nlength mod max packet size is 0. When transfer complete, run to line 831,\\nusb_gadget_giveback_request() will free this requestion. 836 condition is\\ntrue, so cdns3_gadget_ep_free_request() free this request again.\\n\\nLog:\\n\\n[ 1920.140696][  T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\\n[ 1920.140696][  T150]\\n[ 1920.151837][  T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36):\\n[ 1920.159082][  T150]  cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\\n[ 1920.164988][  T150]  cdns3_transfer_completed+0x438/0x5f8 [cdns3]\\n\\nAdd check at line 829, skip call usb_gadget_giveback_request() if it is\\nadditional zero length packet request. Needn\u0027t call\\nusb_gadget_giveback_request() because it is allocated in this driver.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: cdns3: corrige la memoria doblemente libre cuando se maneja el paquete cero 829 if (request-\u0026gt;complete) { 830 spin_unlock(\u0026amp;priv_dev-\u0026gt;lock); 831 usb_gadget_giveback_request(\u0026amp;priv_ep-\u0026gt;endpoint, solicitud 832); 833 spin_lock(\u0026amp;priv_dev-\u0026gt;lock); 834 } 835 836 if (solicitud-\u0026gt;buf == priv_dev-\u0026gt;zlp_buf) 837 cdns3_gadget_ep_free_request(\u0026amp;priv_ep-\u0026gt;endpoint, solicitud); El controlador agrega una solicitud de paquete cero adicional cuando pone en cola un paquete, cuya longitud mod tama\u00f1o m\u00e1ximo del paquete es 0. Cuando se complete la transferencia, ejecute la l\u00ednea 831, usb_gadget_giveback_request() liberar\u00e1 esta solicitud. La condici\u00f3n 836 es verdadera, por lo que cdns3_gadget_ep_free_request() libera esta solicitud nuevamente. Registro: [1920.140696][ T150] ERROR: KFENCE: lectura de uso despu\u00e9s de liberaci\u00f3n en cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.140696][ T150] [ 1920.151837][ T150] Lectura de uso despu\u00e9s de liberaci\u00f3n en 0x000000003d 1cd10b (en kcerca -#36): [ 1920.159082][ T150] cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.164988][ T150] cdns3_transfer_completed+0x438/0x5f8 [cdns3] Agregar cheque en la l\u00ednea 829, omitir llamada usb_gadget_giveback_ request() si tiene una longitud cero adicional solicitud de paquete. No es necesario llamar a usb_gadget_giveback_request() porque est\u00e1 asignado en este controlador.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/cdns3/cdns3-gadget.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7733f6c32e36ff9d7adadf40001039bf219b1cbe\",\"lessThan\":\"aad6132ae6e4809e375431f8defd1521985e44e7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7733f6c32e36ff9d7adadf40001039bf219b1cbe\",\"lessThan\":\"1e204a8e9eb514e22a6567fb340ebb47df3f3a48\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7733f6c32e36ff9d7adadf40001039bf219b1cbe\",\"lessThan\":\"3a2a909942b5335b7ea66366d84261b3ed5f89c8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7733f6c32e36ff9d7adadf40001039bf219b1cbe\",\"lessThan\":\"9a52b694b066f299d8b9800854a8503457a8b64c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7733f6c32e36ff9d7adadf40001039bf219b1cbe\",\"lessThan\":\"70e8038813f9d3e72df966748ebbc40efe466019\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7733f6c32e36ff9d7adadf40001039bf219b1cbe\",\"lessThan\":\"92d20406a3d4ff3e8be667c79209dc9ed31df5b3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7733f6c32e36ff9d7adadf40001039bf219b1cbe\",\"lessThan\":\"5fd9e45f1ebcd57181358af28506e8a661a260b3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/cdns3/cdns3-gadget.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.270\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.211\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.150\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.80\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.19\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.7\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-05T17:31:00.230088Z\",\"id\":\"CVE-2024-26748\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4\",\"versionEndExcluding\":\"5.4.270\",\"matchCriteriaId\":\"AB9FB43C-52F9-4B49-B6C0-160353C9C9AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.211\",\"matchCriteriaId\":\"7DDA4DCF-671D-415D-94DF-6E3C77DF0704\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.150\",\"matchCriteriaId\":\"CB6C60DE-9E0C-46C5-904D-D4F4031F8E95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.80\",\"matchCriteriaId\":\"BA7850CE-97C9-4408-A348-6173296BCA2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.19\",\"matchCriteriaId\":\"8D82004C-B2AE-4048-9344-32EFF65953B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.7\",\"matchCriteriaId\":\"575EE16B-67F2-4B5B-B5F8-1877715C898B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1e204a8e9eb514e22a6567fb340ebb47df3f3a48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a2a909942b5335b7ea66366d84261b3ed5f89c8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5fd9e45f1ebcd57181358af28506e8a661a260b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70e8038813f9d3e72df966748ebbc40efe466019\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/92d20406a3d4ff3e8be667c79209dc9ed31df5b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a52b694b066f299d8b9800854a8503457a8b64c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aad6132ae6e4809e375431f8defd1521985e44e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1e204a8e9eb514e22a6567fb340ebb47df3f3a48\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a2a909942b5335b7ea66366d84261b3ed5f89c8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5fd9e45f1ebcd57181358af28506e8a661a260b3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70e8038813f9d3e72df966748ebbc40efe466019\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/92d20406a3d4ff3e8be667c79209dc9ed31df5b3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a52b694b066f299d8b9800854a8503457a8b64c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aad6132ae6e4809e375431f8defd1521985e44e7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:50:11+00:00",
      "cve": "CVE-2024-26748",
      "id": "CVE-2024-26748",
      "initial_release_date": "2024-04-03T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: cdns3: fix memory double free when handle zero packet",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26748.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T16:56:46Z",
      "cve": "CVE-2024-26748",
      "id": "CVE-2024-26748",
      "initial_release_date": "2024-04-10T02:16:33Z",
      "product_status:known_affected": "362",
      "product_status:known_not_affected": "233",
      "product_status:recommended": "519",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26748",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26748.json",
      "version": "57"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/aad6132ae6e4809e375431f8defd1521985e44e7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1e204a8e9eb514e22a6567fb340ebb47df3f3a48\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a2a909942b5335b7ea66366d84261b3ed5f89c8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9a52b694b066f299d8b9800854a8503457a8b64c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/70e8038813f9d3e72df966748ebbc40efe466019\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/92d20406a3d4ff3e8be667c79209dc9ed31df5b3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5fd9e45f1ebcd57181358af28506e8a661a260b3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.207Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26748\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-05T17:31:00.230088Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:22.217Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"usb: cdns3: fix memory double free when handle zero packet\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is selected entirely by locally queued transfer parameters (`req-\u003ezero` plus `length % maxpacket == 0`) set by in-kernel function drivers on behalf of local userspace \\u2014 USB-Ethernet/NCM tethering, the printer gadget, UVC streaming \\u2014 not by anything a USB peer supplies, so no physical action by the attacker is needed on a peripheral in its normal connected operating state. This matches the AV:L treatment of the sibling cdns3 gadget flaw CVE-2024-26747.\\nAC:L - The attacker fully controls the transfer length, and the ZLP request append plus the buggy giveback sequence follow deterministically; the lock-drop window around `usb_gadget_giveback_request()` is one the attacker widens at will by queuing transfers concurrently from multiple threads.\\nPR:L - Once the gadget is configured (normal system state on these embedded boards), any unprivileged process can drive the path \\u2014 e.g. sending a UDP datagram sized so the NCM/ECM frame is an exact multiple of the 512/1024-byte bulk-IN maxpacket over `usb0`, or writing to `/dev/g_printer0` or the UVC gadget node \\u2014 with no capability check anywhere on the path.\\nUI:N - No victim action is required; the affected devices operate as USB peripherals attached to a host as their normal deployed state, and the attacker triggers the flaw purely by generating traffic.\\nS:U - The corruption is confined to kernel heap memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The flaw includes a confirmed use-after-free read of a freed `struct cdns3_request` (KFENCE-reported), and the double free of a kmalloc-192 general-cache object lets an attacker reallocate it with sprayed data and have the driver disclose or act on it, enabling arbitrary kernel memory disclosure.\\nI:H - Freeing a still-live request returns an in-use object to the general slab allocator while the driver continues writing into it (`request-\u003eactual`, `finished_trb`, TRB pointers, list linkage), a classic double-free/UAF write primitive leveragable for control-flow hijack and privilege escalation.\\nA:H - The double free corrupts slab freelists and the endpoint request lists, reliably producing kernel oops/panic, and it can be re-triggered at will by an unprivileged local process.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7733f6c32e36ff9d7adadf40001039bf219b1cbe\", \"lessThan\": \"aad6132ae6e4809e375431f8defd1521985e44e7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7733f6c32e36ff9d7adadf40001039bf219b1cbe\", \"lessThan\": \"1e204a8e9eb514e22a6567fb340ebb47df3f3a48\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7733f6c32e36ff9d7adadf40001039bf219b1cbe\", \"lessThan\": \"3a2a909942b5335b7ea66366d84261b3ed5f89c8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7733f6c32e36ff9d7adadf40001039bf219b1cbe\", \"lessThan\": \"9a52b694b066f299d8b9800854a8503457a8b64c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7733f6c32e36ff9d7adadf40001039bf219b1cbe\", \"lessThan\": \"70e8038813f9d3e72df966748ebbc40efe466019\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7733f6c32e36ff9d7adadf40001039bf219b1cbe\", \"lessThan\": \"92d20406a3d4ff3e8be667c79209dc9ed31df5b3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7733f6c32e36ff9d7adadf40001039bf219b1cbe\", \"lessThan\": \"5fd9e45f1ebcd57181358af28506e8a661a260b3\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/usb/cdns3/cdns3-gadget.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.270\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.211\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.150\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.80\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/usb/cdns3/cdns3-gadget.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/aad6132ae6e4809e375431f8defd1521985e44e7\"}, {\"url\": \"https://git.kernel.org/stable/c/1e204a8e9eb514e22a6567fb340ebb47df3f3a48\"}, {\"url\": \"https://git.kernel.org/stable/c/3a2a909942b5335b7ea66366d84261b3ed5f89c8\"}, {\"url\": \"https://git.kernel.org/stable/c/9a52b694b066f299d8b9800854a8503457a8b64c\"}, {\"url\": \"https://git.kernel.org/stable/c/70e8038813f9d3e72df966748ebbc40efe466019\"}, {\"url\": \"https://git.kernel.org/stable/c/92d20406a3d4ff3e8be667c79209dc9ed31df5b3\"}, {\"url\": \"https://git.kernel.org/stable/c/5fd9e45f1ebcd57181358af28506e8a661a260b3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: cdns3: fix memory double free when handle zero packet\\n\\n829  if (request-\u003ecomplete) {\\n830          spin_unlock(\u0026priv_dev-\u003elock);\\n831          usb_gadget_giveback_request(\u0026priv_ep-\u003eendpoint,\\n832                                    request);\\n833          spin_lock(\u0026priv_dev-\u003elock);\\n834  }\\n835\\n836  if (request-\u003ebuf == priv_dev-\u003ezlp_buf)\\n837      cdns3_gadget_ep_free_request(\u0026priv_ep-\u003eendpoint, request);\\n\\nDriver append an additional zero packet request when queue a packet, which\\nlength mod max packet size is 0. When transfer complete, run to line 831,\\nusb_gadget_giveback_request() will free this requestion. 836 condition is\\ntrue, so cdns3_gadget_ep_free_request() free this request again.\\n\\nLog:\\n\\n[ 1920.140696][  T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\\n[ 1920.140696][  T150]\\n[ 1920.151837][  T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36):\\n[ 1920.159082][  T150]  cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\\n[ 1920.164988][  T150]  cdns3_transfer_completed+0x438/0x5f8 [cdns3]\\n\\nAdd check at line 829, skip call usb_gadget_giveback_request() if it is\\nadditional zero length packet request. Needn\u0027t call\\nusb_gadget_giveback_request() because it is allocated in this driver.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.270\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.211\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.150\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.80\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.19\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.7\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:59.831Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26748\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:59.831Z\", \"dateReserved\": \"2024-02-19T14:20:24.168Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T17:00:35.087Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.