CVE-2024-26919 (GCVE-0-2024-26919)
Vulnerability from cvelistv5
Published
2024-04-17 15:59
Modified
2026-08-05 11:28
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: Fix debugfs directory leak The ULPI per-device debugfs root is named after the ulpi device's parent, but ulpi_unregister_interface tries to remove a debugfs directory named after the ulpi device itself. This results in the directory sticking around and preventing subsequent (deferred) probes from succeeding. Change the directory name to match the ulpi device.
References
Impacted products
Vendor Product Version
Linux Linux Version: bd0a0a024f2a41e7cc8eadb9862f82c45884b69c
Version: bd0a0a024f2a41e7cc8eadb9862f82c45884b69c
Version: bd0a0a024f2a41e7cc8eadb9862f82c45884b69c
Version: bd0a0a024f2a41e7cc8eadb9862f82c45884b69c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26919",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-23T14:00:39.264752Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:38.512Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.553Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/common/ulpi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d31b886ed6a5095214062ee4fb55037eb930adb6",
              "status": "affected",
              "version": "bd0a0a024f2a41e7cc8eadb9862f82c45884b69c",
              "versionType": "git"
            },
            {
              "lessThan": "330d22aba17a4d30a56f007d0f51291d7e00862b",
              "status": "affected",
              "version": "bd0a0a024f2a41e7cc8eadb9862f82c45884b69c",
              "versionType": "git"
            },
            {
              "lessThan": "33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3",
              "status": "affected",
              "version": "bd0a0a024f2a41e7cc8eadb9862f82c45884b69c",
              "versionType": "git"
            },
            {
              "lessThan": "3caf2b2ad7334ef35f55b95f3e1b138c6f77b368",
              "status": "affected",
              "version": "bd0a0a024f2a41e7cc8eadb9862f82c45884b69c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/common/ulpi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.79",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: ulpi: Fix debugfs directory leak\n\nThe ULPI per-device debugfs root is named after the ulpi device\u0027s\nparent, but ulpi_unregister_interface tries to remove a debugfs\ndirectory named after the ulpi device itself. This results in the\ndirectory sticking around and preventing subsequent (deferred) probes\nfrom succeeding. Change the directory name to match the ulpi device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The use-after-free is triggered by a local read of `/sys/kernel/debug/ulpi/\u003cparent\u003e/regs`, a local filesystem operation on the affected host. No network protocol or physical device insertion is involved \u2014 the ULPI PHY is an on-board SoC component, not a hot-pluggable peripheral.\nAC:L - The stale debugfs entry is created deterministically by any deferred probe or driver unbind (`goto ulpi_exit` in `ci_hdrc_probe`), and every subsequent read reliably dereferences the freed `struct ulpi` and indirect-calls `ulpi-\u003eops-\u003eread`. The attacker fully controls when the read happens, so heap grooming between the `kfree()` and the read is entirely within their control \u2014 no condition depends on external state.\nPR:L - The kernel itself publishes the leaked directory as 0755 and the `regs` file as 0444, so any local user who can traverse the debugfs mount can trigger the UAF; on the ULPI-bearing platforms that matter (Android handsets, automotive/industrial chipidea and dwc3 boards) debugfs is commonly mounted with relaxed mode or group access for diagnostics daemons. No capability, namespace privilege, or kernel-enforced access check guards the vulnerable file.\nUI:N - The attacker performs the read themselves; no victim action is required. The dangling pointer arises automatically from normal deferred-probe behavior at boot.\nS:U - The freed object, the corrupted heap, and the hijackable indirect call all live within the kernel\u0027s own security authority. There is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a use-after-free on a ~1KB slab object; reclaiming the freed `struct ulpi` with attacker-shaped data and reading `regs` turns `ulpi-\u003eops-\u003eread` into a controlled call, which is a general kernel-memory disclosure primitive. Even without grooming, the file dumps values derived from freed kernel heap contents.\nI:H - `ulpi_read()` loads a function pointer out of freed memory and indirect-calls it (21 times per read of `regs`), giving direct control-flow hijack once the slab slot is reclaimed \u2014 a full arbitrary-write/code-execution primitive, not just corruption.\nA:H - Dereferencing the freed `struct ulpi` and calling through a garbage `ops` pointer oopses or panics the kernel, and the stale entry can be read repeatedly. Per kernel scoring guidance any use-after-free is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:18.079Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b"
        },
        {
          "url": "https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368"
        }
      ],
      "title": "usb: ulpi: Fix debugfs directory leak",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26919",
    "datePublished": "2024-04-17T15:59:27.581Z",
    "dateReserved": "2024-02-19T14:20:24.193Z",
    "dateUpdated": "2026-08-05T11:28:18.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:05.553Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26919\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-23T14:00:39.264752Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:23.950Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"usb: ulpi: Fix debugfs directory leak\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The use-after-free is triggered by a local read of `/sys/kernel/debug/ulpi/\u003cparent\u003e/regs`, a local filesystem operation on the affected host. No network protocol or physical device insertion is involved \\u2014 the ULPI PHY is an on-board SoC component, not a hot-pluggable peripheral.\\nAC:L - The stale debugfs entry is created deterministically by any deferred probe or driver unbind (`goto ulpi_exit` in `ci_hdrc_probe`), and every subsequent read reliably dereferences the freed `struct ulpi` and indirect-calls `ulpi-\u003eops-\u003eread`. The attacker fully controls when the read happens, so heap grooming between the `kfree()` and the read is entirely within their control \\u2014 no condition depends on external state.\\nPR:L - The kernel itself publishes the leaked directory as 0755 and the `regs` file as 0444, so any local user who can traverse the debugfs mount can trigger the UAF; on the ULPI-bearing platforms that matter (Android handsets, automotive/industrial chipidea and dwc3 boards) debugfs is commonly mounted with relaxed mode or group access for diagnostics daemons. No capability, namespace privilege, or kernel-enforced access check guards the vulnerable file.\\nUI:N - The attacker performs the read themselves; no victim action is required. The dangling pointer arises automatically from normal deferred-probe behavior at boot.\\nS:U - The freed object, the corrupted heap, and the hijackable indirect call all live within the kernel\u0027s own security authority. There is no VM, IOMMU, or sandbox boundary crossed.\\nC:H - This is a use-after-free on a ~1KB slab object; reclaiming the freed `struct ulpi` with attacker-shaped data and reading `regs` turns `ulpi-\u003eops-\u003eread` into a controlled call, which is a general kernel-memory disclosure primitive. Even without grooming, the file dumps values derived from freed kernel heap contents.\\nI:H - `ulpi_read()` loads a function pointer out of freed memory and indirect-calls it (21 times per read of `regs`), giving direct control-flow hijack once the slab slot is reclaimed \\u2014 a full arbitrary-write/code-execution primitive, not just corruption.\\nA:H - Dereferencing the freed `struct ulpi` and calling through a garbage `ops` pointer oopses or panics the kernel, and the stale entry can be read repeatedly. Per kernel scoring guidance any use-after-free is High availability impact.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"bd0a0a024f2a41e7cc8eadb9862f82c45884b69c\", \"lessThan\": \"d31b886ed6a5095214062ee4fb55037eb930adb6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bd0a0a024f2a41e7cc8eadb9862f82c45884b69c\", \"lessThan\": \"330d22aba17a4d30a56f007d0f51291d7e00862b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bd0a0a024f2a41e7cc8eadb9862f82c45884b69c\", \"lessThan\": \"33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bd0a0a024f2a41e7cc8eadb9862f82c45884b69c\", \"lessThan\": \"3caf2b2ad7334ef35f55b95f3e1b138c6f77b368\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/usb/common/ulpi.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.79\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/usb/common/ulpi.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6\"}, {\"url\": \"https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b\"}, {\"url\": \"https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3\"}, {\"url\": \"https://git.kernel.org/stable/c/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: ulpi: Fix debugfs directory leak\\n\\nThe ULPI per-device debugfs root is named after the ulpi device\u0027s\\nparent, but ulpi_unregister_interface tries to remove a debugfs\\ndirectory named after the ulpi device itself. This results in the\\ndirectory sticking around and preventing subsequent (deferred) probes\\nfrom succeeding. Change the directory name to match the ulpi device.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.79\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.18\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:28:18.079Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26919\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:28:18.079Z\", \"dateReserved\": \"2024-02-19T14:20:24.193Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T15:59:27.581Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.