CVE-2024-36896

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to a bug in the Linux kernel's USB core, specifically in the port.c file, where the disable store() function does not check if the hub that the port belongs to has been concurrently removed before dereferencing the returned value of usb hub to struct hub(). This can lead to a null pointer dereference. The same bug exists in the disable show() routine. The problem can be fixed by adding a check for hub == NULL.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.