CVE-2024-26716
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-26716
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26716.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-26716
- Downstream
- Published
- 2024-04-03T15:15:53Z
- Modified
- 2025-08-09T19:01:27Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
usb: core: Prevent null pointer dereference in updateportdevice_state
Currently, the function updateportdevicestate gets the usbhub from udev->parent by calling usbhubtostructhub. However, in case the actconfig or the maxchild is 0, the usbhub would be NULL and upon further accessing to get portdev would result in null pointer dereference.
Fix this by introducing an if check after the usb_hub is populated.
- References