CVE-2024-26715: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26715 is a NULL pointer dereference vulnerability discovered in the Linux kernel's USB DWC3 gadget driver. The vulnerability was disclosed on April 3, 2024, affecting multiple versions of the Linux kernel from 3.16.81 through 6.8 RC2. The issue occurs in the dwc3_gadget_suspend function when plug-out and plug-in operations are performed continuously (NVD).

The vulnerability stems from a race condition in the dwc3_gadget_suspend function where a NULL pointer dereference can occur during concurrent operations. The issue manifests when CPU1 clears the gadget_driver variable while CPU2 checks it in dwc3_gadget_suspend. If CPU2 finds dwc->gadget_driver as non-NULL and continues execution while CPU1 completes clearing it, a NULL pointer dereference occurs when CPU2 later attempts to access the now-NULL pointer in dwc3_disconnect_gadget. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Kernel Patch).

The vulnerability can lead to a denial of service condition through system crashes when exploited. The impact is limited to availability with no direct effects on confidentiality or integrity of the system (NVD).

The vulnerability requires local access and low privileges to exploit. It can be triggered through specific USB device plug-out and plug-in sequences, making it relatively straightforward to exploit in environments where an attacker has physical access to the device (NVD).

The vulnerability has been patched in multiple Linux kernel versions. The fix involves modifying the dwc3_gadget_suspend function to check the gadget_driver pointer status within a locked section, preventing the race condition. The patch has been backported to affected stable kernel versions (Kernel Patch).