{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-26919","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.193Z","datePublished":"2024-04-17T15:59:27.581Z","dateUpdated":"2026-08-05T11:28:18.079Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:28:18.079Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: ulpi: Fix debugfs directory leak\n\nThe ULPI per-device debugfs root is named after the ulpi device's\nparent, but ulpi_unregister_interface tries to remove a debugfs\ndirectory named after the ulpi device itself. This results in the\ndirectory sticking around and preventing subsequent (deferred) probes\nfrom succeeding. Change the directory name to match the ulpi device."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The use-after-free is triggered by a local read of `/sys/kernel/debug/ulpi/<parent>/regs`, a local filesystem operation on the affected host. No network protocol or physical device insertion is involved — the ULPI PHY is an on-board SoC component, not a hot-pluggable peripheral.\nAC:L - The stale debugfs entry is created deterministically by any deferred probe or driver unbind (`goto ulpi_exit` in `ci_hdrc_probe`), and every subsequent read reliably dereferences the freed `struct ulpi` and indirect-calls `ulpi->ops->read`. The attacker fully controls when the read happens, so heap grooming between the `kfree()` and the read is entirely within their control — no condition depends on external state.\nPR:L - The kernel itself publishes the leaked directory as 0755 and the `regs` file as 0444, so any local user who can traverse the debugfs mount can trigger the UAF; on the ULPI-bearing platforms that matter (Android handsets, automotive/industrial chipidea and dwc3 boards) debugfs is commonly mounted with relaxed mode or group access for diagnostics daemons. No capability, namespace privilege, or kernel-enforced access check guards the vulnerable file.\nUI:N - The attacker performs the read themselves; no victim action is required. The dangling pointer arises automatically from normal deferred-probe behavior at boot.\nS:U - The freed object, the corrupted heap, and the hijackable indirect call all live within the kernel's own security authority. There is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a use-after-free on a ~1KB slab object; reclaiming the freed `struct ulpi` with attacker-shaped data and reading `regs` turns `ulpi->ops->read` into a controlled call, which is a general kernel-memory disclosure primitive. Even without grooming, the file dumps values derived from freed kernel heap contents.\nI:H - `ulpi_read()` loads a function pointer out of freed memory and indirect-calls it (21 times per read of `regs`), giving direct control-flow hijack once the slab slot is reclaimed — a full arbitrary-write/code-execution primitive, not just corruption.\nA:H - Dereferencing the freed `struct ulpi` and calling through a garbage `ops` pointer oopses or panics the kernel, and the stale entry can be read repeatedly. Per kernel scoring guidance any use-after-free is High availability impact."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/common/ulpi.c"],"versions":[{"version":"bd0a0a024f2a41e7cc8eadb9862f82c45884b69c","lessThan":"d31b886ed6a5095214062ee4fb55037eb930adb6","status":"affected","versionType":"git"},{"version":"bd0a0a024f2a41e7cc8eadb9862f82c45884b69c","lessThan":"330d22aba17a4d30a56f007d0f51291d7e00862b","status":"affected","versionType":"git"},{"version":"bd0a0a024f2a41e7cc8eadb9862f82c45884b69c","lessThan":"33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3","status":"affected","versionType":"git"},{"version":"bd0a0a024f2a41e7cc8eadb9862f82c45884b69c","lessThan":"3caf2b2ad7334ef35f55b95f3e1b138c6f77b368","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/common/ulpi.c"],"versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","status":"unaffected","versionType":"semver"},{"version":"6.1.79","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.18","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.6","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.1.79"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.6.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.7.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6"},{"url":"https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b"},{"url":"https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3"},{"url":"https://git.kernel.org/stable/c/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368"}],"title":"usb: ulpi: Fix debugfs directory leak","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-26919","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-23T14:00:39.264752Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-04T17:49:38.512Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:21:05.553Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/d31b886ed6a5095214062ee4fb55037eb930adb6","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/330d22aba17a4d30a56f007d0f51291d7e00862b","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/3caf2b2ad7334ef35f55b95f3e1b138c6f77b368","tags":["x_transferred"]}]}]}}