CVE-2024-26747: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26747 is a vulnerability in the Linux kernel's USB role class driver that was discovered and disclosed on April 3, 2024. The vulnerability affects the module reference handling in the USB role switch functionality. The issue occurs in the usb_role_switch parent's module reference management, where a NULL pointer dereference can occur when putting the module's reference (NVD).

The vulnerability stems from a design flaw in the USB role class driver where the driver gets the usb_role_switch parent's module reference after the user gets the usb_role_switch device and puts the reference after the user puts the usb_role_switch device. However, if the parent device of usb_role_switch is removed before the user puts the usb_role_switch, a NULL pointer dereference can occur. The issue has been assigned a CVSS v3.1 base score of 4.4 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (CISA-ADP).

The vulnerability can lead to a NULL pointer dereference when putting the parent module's reference, potentially causing a system crash or denial of service condition. The impact is limited to local attacks requiring high privileges (NVD).

The vulnerability requires local access with high privileges to exploit. It has been classified as a NULL Pointer Dereference (CWE-476) vulnerability. There are no known reports of this vulnerability being exploited in the wild (NVD).

The vulnerability has been fixed in various Linux kernel versions. The fix involves saving the module pointer in the structure of usb_role_switch, eliminating the need to find the module by iterating through long relations. Ubuntu has released patches for affected versions, including fixes in version 5.15.0-1063.69 for Ubuntu 22.04 LTS and other versions (Ubuntu Security).