CVE-2024-57981
Description
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix NULL pointer dereference on certain command aborts If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB and no further. If the command is later aborted, when the abort completion is handled the dequeue pointer is advanced to the first TRB of the next segment. If no further commands are queued, xhci_handle_stopped_cmd_ring() sees the ring pointers unequal and assumes that there is a pending command, so it calls xhci_mod_cmd_timer() which crashes if cur_cmd was NULL. Don't attempt timer setup if cur_cmd is NULL. The subsequent doorbell ring likely is unnecessary too, but it's harmless. Leave it alone. This is probably Bug 219532, but no confirmation has been received. The issue has been independently reproduced and confirmed fixed using a USB MCU programmed to NAK the Status stage of SET_ADDRESS forever. Everything continued working normally after several prevented crashes.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/9/ALSA-2025-20518.html
Vendor advisory: alma — https://bugzilla.redhat.com/2383441
Vendor advisory: alma — https://bugzilla.redhat.com/2376076
Vendor advisory: alma — https://bugzilla.redhat.com/2369184
Vendor advisory: alma — https://bugzilla.redhat.com/2363380
Vendor advisory: alma — https://bugzilla.redhat.com/2360215
Vendor advisory: alma — https://bugzilla.redhat.com/2351633
Vendor advisory: alma — https://bugzilla.redhat.com/2351629
Vendor advisory: alma — https://bugzilla.redhat.com/2351625
Vendor advisory: alma — https://bugzilla.redhat.com/2351624
Vendor advisory: alma — https://bugzilla.redhat.com/2351620
Vendor advisory: alma — https://bugzilla.redhat.com/2351618
Vendor advisory: alma — https://bugzilla.redhat.com/2351616
Vendor advisory: alma — https://bugzilla.redhat.com/2351613
Vendor advisory: alma — https://bugzilla.redhat.com/2351612
Vendor advisory: alma — https://bugzilla.redhat.com/2351608
Vendor advisory: alma — https://bugzilla.redhat.com/2351606
Vendor advisory: alma — https://bugzilla.redhat.com/2350726
Vendor advisory: alma — https://bugzilla.redhat.com/2350725
Vendor advisory: alma — https://bugzilla.redhat.com/2350589
Vendor advisory: alma — https://bugzilla.redhat.com/2350585
Vendor advisory: alma — https://bugzilla.redhat.com/2350400
Vendor advisory: alma — https://bugzilla.redhat.com/2350397
Vendor advisory: alma — https://bugzilla.redhat.com/2350396
Vendor advisory: alma — https://bugzilla.redhat.com/2350392
Vendor advisory: alma — https://bugzilla.redhat.com/2350388
Vendor advisory: alma — https://bugzilla.redhat.com/2350386
Vendor advisory: alma — https://bugzilla.redhat.com/2350375
Vendor advisory: alma — https://bugzilla.redhat.com/2350374
Vendor advisory: alma — https://bugzilla.redhat.com/2350367
Vendor advisory: alma — https://bugzilla.redhat.com/2350363
Vendor advisory: alma — https://bugzilla.redhat.com/2348901
Vendor advisory: alma — https://bugzilla.redhat.com/2348654
Vendor advisory: alma — https://bugzilla.redhat.com/2348650
Vendor advisory: alma — https://bugzilla.redhat.com/2348645
Vendor advisory: alma — https://bugzilla.redhat.com/2348634
Vendor advisory: alma — https://bugzilla.redhat.com/2348625
Vendor advisory: alma — https://bugzilla.redhat.com/2348620
Vendor advisory: alma — https://bugzilla.redhat.com/2348615
Vendor advisory: alma — https://bugzilla.redhat.com/2348601
Vendor advisory: alma — https://bugzilla.redhat.com/2348600
Vendor advisory: alma — https://bugzilla.redhat.com/2348597
Vendor advisory: alma — https://bugzilla.redhat.com/2348595
Vendor advisory: alma — https://bugzilla.redhat.com/2348587
Vendor advisory: alma — https://bugzilla.redhat.com/2348585
Vendor advisory: alma — https://bugzilla.redhat.com/2348584
Vendor advisory: alma — https://bugzilla.redhat.com/2348581
Vendor advisory: alma — https://bugzilla.redhat.com/2348578
Vendor advisory: alma — https://bugzilla.redhat.com/2348577
Vendor advisory: alma — https://bugzilla.redhat.com/2348574
Vendor advisory: alma — https://bugzilla.redhat.com/2348573
Vendor advisory: alma — https://bugzilla.redhat.com/2348566
Vendor advisory: alma — https://bugzilla.redhat.com/2348556
Vendor advisory: alma — https://bugzilla.redhat.com/2348554
Vendor advisory: alma — https://bugzilla.redhat.com/2348550
Vendor advisory: alma — https://bugzilla.redhat.com/2348547
Vendor advisory: alma — https://bugzilla.redhat.com/2348543
Vendor advisory: alma — https://bugzilla.redhat.com/2348541
Vendor advisory: alma — https://bugzilla.redhat.com/2348528
Vendor advisory: alma — https://bugzilla.redhat.com/2348523
Vendor advisory: alma — https://bugzilla.redhat.com/2348515
Vendor advisory: alma — https://bugzilla.redhat.com/2348279
Vendor advisory: alma — https://bugzilla.redhat.com/2348240
Vendor advisory: alma — https://bugzilla.redhat.com/2348238
Vendor advisory: alma — https://bugzilla.redhat.com/2348071
Vendor advisory: alma — https://bugzilla.redhat.com/2348022
Vendor advisory: alma — https://bugzilla.redhat.com/2347968
Vendor advisory: alma — https://bugzilla.redhat.com/2347919
Vendor advisory: alma — https://bugzilla.redhat.com/2347859
Vendor advisory: alma — https://bugzilla.redhat.com/2347807
Vendor advisory: alma — https://bugzilla.redhat.com/2347781
Vendor advisory: alma — https://bugzilla.redhat.com/2347759
Vendor advisory: alma — https://bugzilla.redhat.com/2347753
Vendor advisory: alma — https://bugzilla.redhat.com/2347707
Vendor advisory: alma — https://bugzilla.redhat.com/2346272
Vendor advisory: alma — https://bugzilla.redhat.com/2345240
Vendor advisory: alma — https://bugzilla.redhat.com/2344687
Vendor advisory: alma — https://bugzilla.redhat.com/2344684
Vendor advisory: alma — https://bugzilla.redhat.com/2343175
Vendor advisory: alma — https://bugzilla.redhat.com/2343172
Vendor advisory: alma — https://bugzilla.redhat.com/2338832
Vendor advisory: alma — https://bugzilla.redhat.com/2338828
Vendor advisory: alma — https://bugzilla.redhat.com/2338814
Vendor advisory: alma — https://bugzilla.redhat.com/2337124
Vendor advisory: alma — https://bugzilla.redhat.com/2337121
Vendor advisory: alma — https://bugzilla.redhat.com/2336541
Vendor advisory: alma — https://bugzilla.redhat.com/2334829
Vendor advisory: alma — https://bugzilla.redhat.com/2334795
Vendor advisory: alma — https://bugzilla.redhat.com/2334676
Vendor advisory: alma — https://bugzilla.redhat.com/2334560
Vendor advisory: alma — https://bugzilla.redhat.com/2334548
Vendor advisory: alma — https://bugzilla.redhat.com/2334547
Vendor advisory: alma — https://bugzilla.redhat.com/2334537
Vendor advisory: alma — https://bugzilla.redhat.com/2334439
Vendor advisory: alma — https://bugzilla.redhat.com/2334415
Vendor advisory: alma — https://bugzilla.redhat.com/2334396
Vendor advisory: alma — https://bugzilla.redhat.com/2334357
Vendor advisory: alma — https://bugzilla.redhat.com/2331326
Vendor advisory: alma — https://bugzilla.redhat.com/2330341
Vendor advisory: alma — https://bugzilla.redhat.com/2329918
Vendor advisory: alma — https://bugzilla.redhat.com/2327887
Vendor advisory: alma — https://bugzilla.redhat.com/2327374
Vendor advisory: alma — https://bugzilla.redhat.com/2327203
Vendor advisory: alma — https://bugzilla.redhat.com/2324549
Vendor advisory: alma — https://bugzilla.redhat.com/2320722
Vendor advisory: alma — https://bugzilla.redhat.com/2320616
Vendor advisory: alma — https://bugzilla.redhat.com/2320455
Vendor advisory: alma — https://bugzilla.redhat.com/2320259
Vendor advisory: alma — https://bugzilla.redhat.com/2320172
Vendor advisory: alma — https://bugzilla.redhat.com/2313092
Vendor advisory: alma — https://bugzilla.redhat.com/2312077
Vendor advisory: alma — https://bugzilla.redhat.com/2298169
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2024-57981
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2025:20518
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2024-57981.html
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/b649f0d5bc256f691c7d234c3986685d54053de1
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/ae069cd2ba09a2bd6a87a68c59ef0b7ea39cd641
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/4ff18870af793ce2034a6ad746e91d0a3d985b88
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/1e0a19912adb68a4b2b74fd77001c96cd83eb073
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/0ce5c0dac768be14afe2426101b568a0f66bfc4d
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2025:20518
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| sles | affected | | |
| rocky | 9 | fixed | |
| debian | bookworm | fixed | 6.1.129-1 |
| debian | bullseye | fixed | 5.10.237-1 |
| debian | forky | fixed | 6.12.13-1 |
| debian | sid | fixed | 6.12.13-1 |
| debian | trixie | fixed | 6.12.13-1 |
| linux-kernel | affected | 6.1.129 | |
| almalinux | 9 | fixed | kernel-doc-5.14.0-611.5.1.el9_7.noarch.rpm |
References
- https://access.redhat.com/errata/RHSA-2025:20518
- https://git.kernel.org/stable/c/0ce5c0dac768be14afe2426101b568a0f66bfc4d
- https://git.kernel.org/stable/c/1e0a19912adb68a4b2b74fd77001c96cd83eb073
- https://git.kernel.org/stable/c/4ff18870af793ce2034a6ad746e91d0a3d985b88
- https://git.kernel.org/stable/c/ae069cd2ba09a2bd6a87a68c59ef0b7ea39cd641
- https://git.kernel.org/stable/c/b44253956407046e5907d4d72c8fa5b93ae94485
- https://git.kernel.org/stable/c/b649f0d5bc256f691c7d234c3986685d54053de1
- https://git.kernel.org/stable/c/cf30300a216a4f8dce94e11781a866a09d4b50d4
- https://git.kernel.org/stable/c/fd8bfaeba4a85b14427899adec0efb3954300653
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-503939.html
- https://www.suse.com/security/cve/CVE-2024-57981.html
- https://errata.rockylinux.org/RLSA-2025:20518
- https://security-tracker.debian.org/tracker/CVE-2024-57981
- https://bugzilla.redhat.com/2298169
- https://bugzilla.redhat.com/2312077
- https://bugzilla.redhat.com/2313092
- https://bugzilla.redhat.com/2320172
- https://bugzilla.redhat.com/2320259
- https://bugzilla.redhat.com/2320455
- https://bugzilla.redhat.com/2320616
- https://bugzilla.redhat.com/2320722
- https://bugzilla.redhat.com/2324549
CWEs
CWE-476
Verify integrity in audit chain (admin only). AS-IS.