CVE-2024-42226 in Linux
Summary
by MITRE • 07/30/2024
In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB
Some transfer events don't always point to a TRB, and consequently don't have a endpoint ring. In these cases, function handle_tx_event() should not proceed, because if 'ep->skip' is set, the pointer to the endpoint ring is used.
To prevent a potential failure and make the code logical, return after checking the completion code for a Transfer event without TRBs.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The Linux kernel's USB subsystem contains a critical logic flaw within the xHCI host controller driver that can lead to null pointer dereferences or undefined behavior during transfer event processing. Specifically, the vulnerability resides in the handle_tx_event function, which is responsible for handling Transfer Request Block completion events. Under normal circumstances, these events are associated with specific endpoints and their corresponding endpoint rings, allowing the kernel to properly update state and manage resources. However, certain types of transfer events do not always point to a valid TRB, meaning they lack an associated endpoint ring structure. This edge case creates a scenario where the code proceeds under the assumption that necessary data structures are present when they may be absent or invalid.
The core technical flaw occurs when the ep->skip flag is set for such incomplete transfer events. In this specific state, the execution path attempts to access the pointer to the endpoint ring without verifying its validity first. Since some completion codes indicate that no TRB was involved in the event, accessing memory through a potentially null or stale pointer results in a kernel panic or system instability. This represents a classic case of improper input validation where the software fails to check for necessary preconditions before performing operations on data structures. The vulnerability is particularly dangerous because it can be triggered by specific USB device behaviors that generate these atypical completion events, effectively allowing an attacker with physical access to a vulnerable port to cause a denial of service through system crashes.
From a security classification perspective, this issue aligns with CWE-476, which denotes a NULL Pointer Dereference vulnerability. The failure to validate the presence and validity of the endpoint ring before dereferencing it constitutes a direct violation of safe coding practices regarding pointer management. Furthermore, in the context of attack vectors, this flaw can be leveraged for local denial-of-service attacks if an attacker can control or influence USB device behavior connected to the system. While primarily affecting system stability rather than allowing privilege escalation directly, such kernel crashes disrupt service availability and can potentially mask other malicious activities by causing system reboots that clear volatile memory artifacts.
To mitigate this vulnerability, developers must ensure that handle_tx_event performs a rigorous check on the completion code before attempting any operations dependent on endpoint rings. The fix involves returning early from the function if it is determined that no TRB was associated with the transfer event, thereby preventing access to uninitialized or null pointers. System administrators should apply kernel updates provided by their distribution vendors as soon as they become available. For environments where immediate patching is not feasible, restricting physical USB port usage and employing strict device whitelisting policies can reduce the attack surface presented by this flaw. Continuous monitoring of system logs for unexpected kernel panics or oops messages related to xhci_hcd drivers may also help in detecting exploitation attempts or instability caused by this bug before it leads to significant operational disruption.