Vulnerability · Published Apr 17, 2024 · Assigned by Linux
CVE-2024-26919usb: ulpi: Fix debugfs directory leak
High 7.8
In plain English
A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 85.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: Fix debugfs directory leak The ULPI per-device debugfs root is named after the ulpi device's parent, but ulpi_unregister_interface tries to remove a debugfs directory named after the ulpi device itself. This results in the directory sticking around and preventing subsequent (deferred) probes from succeeding. Change the directory name to match the ulpi device.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bpftool | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-abi-stablelists | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-core | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-cross-headers | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-debug | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-debug-core | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-debug-devel | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-debug-modules | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-debug-modules-extra | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-devel | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-doc | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-headers | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-modules | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-modules-extra | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-rt | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-rt-core | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-rt-debug | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-rt-debug-core | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-rt-debug-devel | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-rt-debug-kvm | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-rt-debug-modules | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-rt-debug-modules-extra | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-rt-devel | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-rt-kvm | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-rt-modules | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-rt-modules-extra | 4.18.0-553.5.1.rt7.346.el8_10 | ALSA-2024:3627 |
| AlmaLinux:8 | kernel-tools | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-tools-libs | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-zfcpdump | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-zfcpdump-core | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-zfcpdump-devel | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-zfcpdump-modules | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | kernel-zfcpdump-modules-extra | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | perf | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| AlmaLinux:8 | python3-perf | 4.18.0-553.5.1.el8_10 | ALSA-2024:3618 |
| Debian:12 | linux | 6.1.82-1 | DEBIAN-CVE-2024-26919 |
| Debian:13 | linux | 6.7.7-1 | DEBIAN-CVE-2024-26919 |
| Debian:14 | linux | 6.7.7-1 | DEBIAN-CVE-2024-26919 |
| Rocky Linux:8 | kernel | 0:4.18.0-553.5.1.el8_10 | RLSA-2024:3618 |
| Rocky Linux:8 | kernel-rt | 0:4.18.0-553.5.1.rt7.346.el8_10 | RLSA-2024:3627 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-aws-6.2 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-aws-6.5 | 6.5.0-1023.23~22.04.1 | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-azure-6.2 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-azure-6.5 | 6.5.0-1024.25~22.04.1 | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 6.5.0-1024.26~22.04.1 | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 6.5.0-44.44~22.04.1 | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | 6.5.0-44.44.1~22.04.1 | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | 6.5.0-1023.24 | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-oem-6.5 | 6.5.0-1027.28 | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | 6.5.0-1026.26~22.04.1 | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-riscv-6.5 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | no fix listed | UBUNTU-CVE-2024-26919 |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | 6.5.0-1017.18~22.04.1 | UBUNTU-CVE-2024-26919 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | bd0a0a024f2a41e7cc8eadb9862f82c45884b69c – before d31b886ed6a5095214062ee4fb55037eb930adb6bd0a0a024f2a41e7cc8eadb9862f82c45884b69c – before 330d22aba17a4d30a56f007d0f51291d7e00862bbd0a0a024f2a41e7cc8eadb9862f82c45884b69c – before 33713945cc92ea9c4a1a9479d5c1b7acb7fc4df3bd0a0a024f2a41e7cc8eadb9862f82c45884b69c – before 3caf2b2ad7334ef35f55b95f3e1b138c6f77b368 |
| Linux | Linux | 5.18 |