U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2024-26934 Detail

Description

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in usb_deauthorize_interface() Among the attribute file callback routines in drivers/usb/core/sysfs.c, the interface_authorized_store() function is the only one which acquires a device lock on an ancestor device: It calls usb_deauthorize_interface(), which locks the interface's parent USB device. The will lead to deadlock if another process already owns that lock and tries to remove the interface, whether through a configuration change or because the device has been disconnected. As part of the removal procedure, device_del() waits for all ongoing sysfs attribute callbacks to complete. But usb_deauthorize_interface() can't complete until the device lock has been released, and the lock won't be released until the removal has finished. The mechanism provided by sysfs to prevent this kind of deadlock is to use the sysfs_break_active_protection() function, which tells sysfs not to wait for the attribute callback. Reported-and-tested by: Yue Sun <samsun1006219@gmail.com> Reported by: xingwei lee <xrivendell7@gmail.com>


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource
https://git.kernel.org/stable/c/07acf979da33c721357ff27129edf74c23c036c6 Patch 
https://git.kernel.org/stable/c/122a06f1068bf5e39089863f4f60b1f5d4273384 Patch 
https://git.kernel.org/stable/c/12d6a5681a0a5cecc2af7860f0a1613fa7c6e947 Patch 
https://git.kernel.org/stable/c/1b175bc579f46520b11ecda443bcd2ee4904f66a Patch 
https://git.kernel.org/stable/c/80ba43e9f799cbdd83842fc27db667289b3150f5 Patch 
https://git.kernel.org/stable/c/8cbdd324b41528994027128207fae8100dff094f Patch 
https://git.kernel.org/stable/c/ab062fa3dc69aea88fe62162c5881ba14b50ecc5 Patch 
https://git.kernel.org/stable/c/dbdf66250d2d33e8b27352fcb901de79f3521057 Patch 
https://git.kernel.org/stable/c/e451709573f8be904a8a72d0775bf114d7c291d9 Patch 

Weakness Enumeration

CWE-ID CWE Name Source
CWE-667 Improper Locking cwe source acceptance level NIST  

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

7 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2024-26934
NVD Published Date:
05/01/2024
NVD Last Modified:
11/05/2024
Source:
kernel.org