CVE-2024-26748: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26748 is a memory double-free vulnerability discovered in the Linux kernel's USB Cadence (cdns3) driver. The vulnerability was disclosed on April 3, 2024, affecting Linux kernel versions from 5.4 up to 6.8-rc5. The issue occurs in the USB gadget driver when handling zero-length packets (NVD).

The vulnerability exists in the cdns3 gadget driver where a double-free condition occurs when handling zero-length packets. When the driver appends an additional zero packet request for a packet whose length modulo max packet size is 0, the request is freed twice: first by usb_gadget_giveback_request() and then again by cdns3_gadget_ep_free_request(). This results in a use-after-free condition, as confirmed by KFENCE detection (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could lead to a use-after-free condition in the kernel's USB subsystem. This could potentially result in system crashes, denial of service, or possible code execution with elevated privileges (NVD).

The vulnerability requires local access and low privileges to exploit. It has been detected and confirmed through the kernel's KFENCE (Kernel Electric-Fence) memory safety detector, which reported use-after-free read operations in the cdns3_gadget_giveback function (Kernel Patch).

The vulnerability has been fixed by adding a check to skip calling usb_gadget_giveback_request() if it is an additional zero length packet request. The fix has been implemented in various kernel versions through patches. Users should update their Linux kernel to a patched version (Kernel Patch, Debian LTS).