CVE-2024-26933: Linux Kernel USB Race Condition Flaw

CVE-2024-26933 Overview

CVE-2024-26933 is a deadlock vulnerability in the Linux kernel USB core subsystem. The flaw affects the show and store callback routines for the disable sysfs attribute file in port.c. These callbacks acquire the device lock for the port's parent hub device, creating a deadlock condition when another process holds the hub lock to remove the device or change its configuration. The issue is classified as [CWE-667] Improper Locking and impacts local users with low privileges who can interact with USB port sysfs attributes.

Critical Impact
Local attackers with low privileges can trigger a kernel deadlock affecting USB hub operations, resulting in denial of service and disruption of system availability.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Linux Kernel 6.9-rc1
Systems exposing USB port disable sysfs attributes to local users

Discovery Timeline

2024-05-01 - CVE-2024-26933 published to the National Vulnerability Database
2025-03-07 - Last updated in NVD database

Technical Details for CVE-2024-26933

Vulnerability Analysis

The vulnerability stems from improper locking behavior in the USB core's port handling code. The disable_show() and disable_store() callback routines associated with the disable sysfs attribute in drivers/usb/core/port.c acquire the device lock of the port's parent hub. This locking pattern conflicts with hub removal and reconfiguration operations.

When the hub is being removed or reconfigured, the kernel must remove the hub interface, which in turn requires removing the port device. The device_del() function waits for all outstanding sysfs attribute callbacks to return before releasing the hub lock. The sysfs callbacks cannot return until they acquire that same lock, producing a circular wait condition.

The fix introduces a call to sysfs_break_active_protection(), which instructs the sysfs core to stop waiting for the attribute callback to complete. To prevent the hub structure from being deallocated while the callback is still running, the patch acquires a reference using hub_get() before breaking sysfs protection.

Root Cause

The root cause is a classic lock ordering violation [CWE-667]. The sysfs attribute callbacks and the device removal path attempt to acquire the same hub device lock in an order that produces mutual blocking. Neither path can proceed until the other releases the lock, deadlocking the kernel threads involved.

Attack Vector

Exploitation requires local access with low privileges. An attacker with permission to read or write the disable sysfs attribute under /sys/bus/usb/devices/.../port*/disable can trigger concurrent operations against a hub being removed or reconfigured. The deadlock results in hung kernel tasks, blocked USB subsystem operations, and degraded system availability.

No verified public exploit code is available for this vulnerability. The vulnerability mechanism is documented in the upstream commit messages referenced below.

Detection Methods for CVE-2024-26933

Indicators of Compromise

Kernel hung task warnings (khungtaskd) referencing disable_show, disable_store, or device_del in stack traces
USB hub devices that fail to detach or rebind cleanly
Processes stuck in uninterruptible sleep (D state) when accessing USB port sysfs attributes

Detection Strategies

Monitor dmesg and /var/log/kern.log for INFO: task ... blocked for more than ... seconds messages tied to USB subsystem call paths
Audit access to USB port disable sysfs files using auditd rules targeting /sys/bus/usb/devices/*/port*/disable
Track kernel version inventory across Linux endpoints to identify hosts running unpatched kernels

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on hung task warnings involving USB drivers
Establish baselines for USB hub bind and unbind events; investigate anomalous removal failures
Restrict and monitor local user activity on shared multi-user Linux systems where USB sysfs attributes are reachable

How to Mitigate CVE-2024-26933

Immediate Actions Required

Identify all Linux hosts running affected kernel versions, including 6.9-rc1 and earlier stable branches missing the fix commits
Apply vendor-supplied kernel updates that incorporate the upstream patches from kernel.org
Limit local shell and sysfs access on multi-user systems until patching is complete

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. Apply the kernel update corresponding to your distribution and branch:

Workarounds

Restrict permissions on USB port disable sysfs attributes to root only using udev rules
Disable interactive shell access for untrusted local users on systems that cannot be patched immediately
Avoid concurrent USB hub configuration changes while userspace processes interact with USB port sysfs entries

bash

# Example udev rule to restrict access to USB port disable sysfs attribute
# /etc/udev/rules.d/99-usb-port-disable.rules
SUBSYSTEM=="usb", ACTION=="add", RUN+="/bin/sh -c 'chmod 600 /sys/bus/usb/devices/%k/port*/disable 2>/dev/null || true'"