CVE-2021-47528

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference vulnerability has been resolved in the Linux kernel. The issue occurs in the cdnsp endpoint init() function, where cdnsp ring alloc() is assigned to pep->ring and then dereferenced, potentially leading to a NULL pointer dereference if cdnsp ring alloc() fails. The bug was found by a static analyzer using differential checking to identify inconsistent security operations between two code paths. Multiple researchers have cross-reviewed the bug, and builds with CONFIG USB CDNSP GADGET=y show no new warnings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.