CVE-2024-44960

Q: What is the severity of CVE-2024-44960?

CVE-2024-44960 has a CVSS score of 5.5 (MEDIUM). This CVE describes a null pointer dereference vulnerability in the Linux kernel's USB gadget core. If a USB gadget driver fails to properly set up endpoint descriptors for the current speed, the kernel may crash when accessing uninitialized memory. This affects systems using USB gadget functionality, particularly embedded devices and development systems.

5.5 MEDIUM

Denial of Service

📋 TL;DR

This CVE describes a null pointer dereference vulnerability in the Linux kernel's USB gadget core. If a USB gadget driver fails to properly set up endpoint descriptors for the current speed, the kernel may crash when accessing uninitialized memory. This affects systems using USB gadget functionality, particularly embedded devices and development systems.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when USB gadget functionality is enabled and using improperly configured gadget drivers. Most production systems use standard, well-tested drivers.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially requiring physical intervention to restart affected devices.

🟠

Likely Case

System crash or instability when using improperly configured USB gadget drivers, primarily affecting development environments.

🟢

If Mitigated

No impact for properly configured systems using standard, well-tested USB gadget drivers.

🌐 Internet-Facing: LOW - USB gadget functionality is typically not exposed over network interfaces.

🏢 Internal Only: MEDIUM - Local users or processes with USB gadget access could trigger crashes on vulnerable systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to load or use custom USB gadget drivers. The vulnerability is triggered by malformed descriptors, not arbitrary code execution.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits: 1a9df57d57452b104c46c918569143cf21d7ebf1 and related commits

Vendor Advisory: https://git.kernel.org/stable/c/1a9df57d57452b104c46c918569143cf21d7ebf1

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable USB gadget functionality

linux

Remove or disable USB gadget kernel modules if not required

rmmod g_ether
rmmod g_serial
rmmod g_mass_storage
rmmod usb_f_*
rmmod libcomposite

Blacklist USB gadget modules

linux

Prevent loading of USB gadget modules at boot

echo 'blacklist g_ether' >> /etc/modprobe.d/blacklist-usb-gadget.conf
echo 'blacklist g_serial' >> /etc/modprobe.d/blacklist-usb-gadget.conf
echo 'blacklist g_mass_storage' >> /etc/modprobe.d/blacklist-usb-gadget.conf
update-initramfs -u

🧯 If You Can't Patch

Restrict access to USB gadget configuration to trusted users only
Audit and validate any custom USB gadget drivers before deployment

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if USB gadget modules are loaded: lsmod | grep -E 'g_|usb_f_'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits or is newer than vulnerable versions

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
Null pointer dereference errors mentioning USB gadget or endpoint descriptors

Network Indicators:

None - this is a local kernel vulnerability

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "null pointer") AND ("usb" OR "gadget" OR "endpoint")

📊 Metadata

CVE ID: CVE-2024-44960

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: September 4, 2024

Last Updated: November 3, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable USB gadget functionality

Blacklist USB gadget modules

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities