CVE-2024-26716

Summary

CVE-2024-26716 is a newly identified vulnerability in the Linux kernel. This issue affects the usb: core subsystem and involves a null pointer dereference in the update_port_device_state function. The problem arises when the usb_hub, which is obtained by calling usb_hub_to_struct_hub, is NULL due to the actconfig or maxchild being zero. Accessing the port_dev in such a case results in a null pointer dereference. The vulnerability has been mitigated by introducing an if check after the usb_hub is populated to prevent this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.