https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:41:37 +0000 https://vulnerability.circl.lu/vuln/cve-2024-36896 <p><strong>Affected:</strong> Linux, linux_kernel</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>USB: core: Fix access violation during port device removal</p> <p>Testing with KASAN and syzkaller revealed a bug in port.c:disable_store(): usb_hub_to_struct_hub() can return NULL if the hub that the port belongs to is concurrently removed, but the function does not check for this possibility before dereferencing the returned value.</p> <p>It turns out that the first dereference is unnecessary, since hub-&gt;intfdev is the parent of the port device, so it can be changed easily. Adding a check for hub == NULL prevents further problems.</p> <p>The same bug exists in the disable_show() routine, and it can be fixed the same way.</p> <p><strong>Affected:</strong> Linux, linux_kernel</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>USB: core: Fix access violation during port device removal</p> <p>Testing with KASAN and syzkaller revealed a bug in port.c:disable_store(): usb_hub_to_struct_hub() can return NULL if the hub that the port belongs to is concurrently removed, but the function does not check for this possibility before dereferencing the returned value.</p> <p>It turns out that the first dereference is unnecessary, since hub-&gt;intfdev is the parent of the port device, so it can be changed easily. Adding a check for hub == NULL prevents further problems.</p> <p>The same bug exists in the disable_show() routine, and it can be fixed the same way.</p> https://vulnerability.circl.lu/vuln/cve-2024-36896