CVE-2024-26749: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26749 is a use-after-free vulnerability discovered in the Linux kernel's USB Cadence (cdns3) driver, specifically in the cdns3_gadget_ep_disable() function. The vulnerability was disclosed on April 3, 2024, affecting Linux kernel versions from 5.4 up to versions before 5.4.270, 5.5 to before 5.10.211, 5.11 to before 5.15.150, and 5.16 to before 6.1.80 (NVD).

The vulnerability occurs when the list_del_init() function attempts to use priv_req->list after it has been freed by cdns3_gadget_ep_free_request(). This results in a use-after-free condition that was detected by the kernel's KFENCE (Kernel Electric-Fence) memory safety detector. The issue manifests in the following call sequence: cdns3_gadget_ep_disable -> usb_ep_disable -> ffs_func_eps_disable -> ffs_func_set_alt -> ffs_func_disable. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially lead to system crashes or arbitrary code execution due to the use-after-free condition in the kernel's USB subsystem. The high CVSS score indicates that successful exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires local access and low privileges to exploit. While no public exploits have been identified, the detailed technical information available about the vulnerability's trigger conditions could aid in exploit development (NVD).

The vulnerability has been fixed by moving the list_del_init() call before cdns3_gadget_ep_free_request() in the code. Multiple Linux distributions have released patches, including Ubuntu which has fixed the issue in versions 5.15.0-1063.69 for 22.04 LTS and 5.4.0-1126.136 for 20.04 LTS (Ubuntu). Debian has also addressed this in version 5.10.216-1~deb10u1 (Debian).