In the Linux kernel, the following vulnerability has been resolved:
xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference.
Full-speed devices may need to reconfigure the endpoint 0 Max Packet Size value during enumeration. Usb core calls usbep0reinit() in this case, which ends up calling xhciconfigureendpoint().
On Panther point xHC the xhciconfigureendpoint() function will additionally check and reserve bandwidth in software. Other hosts do this in hardware
If xHC address device command fails then a new xhcivirtdevice structure is allocated as part of re-enabling the slot, but the bandwidth table pointers are not set up properly here. This triggers the NULL pointer dereference the next time usbep0reinit() is called and xhciconfigureendpoint() tries to check and reserve bandwidth
[46710.713538] usb 3-1: new full-speed USB device number 5 using xhcihcd [46710.713699] usb 3-1: Device not responding to setup address. [46710.917684] usb 3-1: Device not responding to setup address. [46711.125536] usb 3-1: device not accepting address 5, error -71 [46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008 [46711.125600] #PF: supervisor read access in kernel mode [46711.125603] #PF: errorcode(0x0000) - not-present page [46711.125606] PGD 0 P4D 0 [46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI [46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.32 #1 [46711.125620] Hardware name: Gigabyte Technology Co., Ltd. [46711.125623] Workqueue: usbhubwq hubevent [usbcore] [46711.125668] RIP: 0010:xhcireservebandwidth (drivers/usb/host/xhci.c
Fix this by making sure bandwidth table pointers are set up correctly after a failed address device command, and additionally by avoiding checking for bandwidth in cases like this where no actual endpoints are added or removed, i.e. only context for default control endpoint 0 is evaluated.
[
    {
        "id": "CVE-2024-45006-1fba947c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_configure_endpoint"
        },
        "digest": {
            "function_hash": "41289104816877985060921168020139424065",
            "length": 2070.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@365ef7c4277fdd781a695c3553fa157d622d805d"
    },
    {
        "id": "CVE-2024-45006-40e1fb7b",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_setup_device"
        },
        "digest": {
            "function_hash": "237292673069119558263354761395263383730",
            "length": 4134.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@365ef7c4277fdd781a695c3553fa157d622d805d"
    },
    {
        "id": "CVE-2024-45006-4af3d4fd",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/usb/host/xhci.c"
        },
        "digest": {
            "line_hashes": [
                "210966616992933520195664822169564418792",
                "123601029581175945132436134825233379173",
                "47258318678105498326729895361288483563",
                "163732246781869669465312481195422408302",
                "276885728956560951269646999171224759014",
                "273283285174845624787254295496525864770",
                "245455610987120693830633323164821980777",
                "64999428298168307695603386161149767116",
                "283071947695599903696547033201778125550"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f0654318e25b2c185e245ba4a591e42fabb5e59"
    },
    {
        "id": "CVE-2024-45006-4cabb2eb",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_configure_endpoint"
        },
        "digest": {
            "function_hash": "41289104816877985060921168020139424065",
            "length": 2070.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fb9d412ebe2f245f13481e4624b40e651570cbd"
    },
    {
        "id": "CVE-2024-45006-55b420fb",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/usb/host/xhci.c"
        },
        "digest": {
            "line_hashes": [
                "210966616992933520195664822169564418792",
                "123601029581175945132436134825233379173",
                "47258318678105498326729895361288483563",
                "163732246781869669465312481195422408302",
                "276885728956560951269646999171224759014",
                "273283285174845624787254295496525864770",
                "245455610987120693830633323164821980777",
                "64999428298168307695603386161149767116",
                "283071947695599903696547033201778125550"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b99de301d78e1f5249e57ef2c32e1dec3df2bb1"
    },
    {
        "id": "CVE-2024-45006-56c4827e",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_configure_endpoint"
        },
        "digest": {
            "function_hash": "109783766413196058119128669530016203582",
            "length": 2051.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef0a0e616b2789bb804a0ce5e161db03170a85b6"
    },
    {
        "id": "CVE-2024-45006-5c0e4820",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/usb/host/xhci.c"
        },
        "digest": {
            "line_hashes": [
                "210966616992933520195664822169564418792",
                "123601029581175945132436134825233379173",
                "47258318678105498326729895361288483563",
                "163732246781869669465312481195422408302",
                "276885728956560951269646999171224759014",
                "273283285174845624787254295496525864770",
                "245455610987120693830633323164821980777",
                "64999428298168307695603386161149767116",
                "283071947695599903696547033201778125550"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af8e119f52e9c13e556be9e03f27957554a84656"
    },
    {
        "id": "CVE-2024-45006-651db33f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/usb/host/xhci.c"
        },
        "digest": {
            "line_hashes": [
                "210966616992933520195664822169564418792",
                "123601029581175945132436134825233379173",
                "47258318678105498326729895361288483563",
                "163732246781869669465312481195422408302",
                "276885728956560951269646999171224759014",
                "273283285174845624787254295496525864770",
                "245455610987120693830633323164821980777",
                "64999428298168307695603386161149767116",
                "283071947695599903696547033201778125550"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a57b0ebabe6862dce0a2e0f13e17941ad72fc56b"
    },
    {
        "id": "CVE-2024-45006-6b2b4a4c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_configure_endpoint"
        },
        "digest": {
            "function_hash": "41289104816877985060921168020139424065",
            "length": 2070.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f0654318e25b2c185e245ba4a591e42fabb5e59"
    },
    {
        "id": "CVE-2024-45006-6d189d08",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_setup_device"
        },
        "digest": {
            "function_hash": "144210568660760801636726603835706051231",
            "length": 4180.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b99de301d78e1f5249e57ef2c32e1dec3df2bb1"
    },
    {
        "id": "CVE-2024-45006-8df13d80",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_setup_device"
        },
        "digest": {
            "function_hash": "237292673069119558263354761395263383730",
            "length": 4134.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a57b0ebabe6862dce0a2e0f13e17941ad72fc56b"
    },
    {
        "id": "CVE-2024-45006-8ec25e05",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_setup_device"
        },
        "digest": {
            "function_hash": "270803804354960806627051428208601096469",
            "length": 3992.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef0a0e616b2789bb804a0ce5e161db03170a85b6"
    },
    {
        "id": "CVE-2024-45006-928d519f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_setup_device"
        },
        "digest": {
            "function_hash": "144210568660760801636726603835706051231",
            "length": 4180.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fb9d412ebe2f245f13481e4624b40e651570cbd"
    },
    {
        "id": "CVE-2024-45006-929de5d0",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_configure_endpoint"
        },
        "digest": {
            "function_hash": "41289104816877985060921168020139424065",
            "length": 2070.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af8e119f52e9c13e556be9e03f27957554a84656"
    },
    {
        "id": "CVE-2024-45006-9430f1a1",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_configure_endpoint"
        },
        "digest": {
            "function_hash": "41289104816877985060921168020139424065",
            "length": 2070.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ad898ae82412f8a689d59829804bff2999dd0ea"
    },
    {
        "id": "CVE-2024-45006-989e6470",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_configure_endpoint"
        },
        "digest": {
            "function_hash": "41289104816877985060921168020139424065",
            "length": 2070.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a57b0ebabe6862dce0a2e0f13e17941ad72fc56b"
    },
    {
        "id": "CVE-2024-45006-ad9f33d5",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/usb/host/xhci.c"
        },
        "digest": {
            "line_hashes": [
                "210966616992933520195664822169564418792",
                "123601029581175945132436134825233379173",
                "47258318678105498326729895361288483563",
                "163732246781869669465312481195422408302",
                "276885728956560951269646999171224759014",
                "273283285174845624787254295496525864770",
                "245455610987120693830633323164821980777",
                "64999428298168307695603386161149767116",
                "283071947695599903696547033201778125550"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8fb9d412ebe2f245f13481e4624b40e651570cbd"
    },
    {
        "id": "CVE-2024-45006-bbdba8ff",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/usb/host/xhci.c"
        },
        "digest": {
            "line_hashes": [
                "210966616992933520195664822169564418792",
                "123601029581175945132436134825233379173",
                "47258318678105498326729895361288483563",
                "163732246781869669465312481195422408302",
                "276885728956560951269646999171224759014",
                "273283285174845624787254295496525864770",
                "245455610987120693830633323164821980777",
                "64999428298168307695603386161149767116",
                "283071947695599903696547033201778125550"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@365ef7c4277fdd781a695c3553fa157d622d805d"
    },
    {
        "id": "CVE-2024-45006-c4bb0577",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_setup_device"
        },
        "digest": {
            "function_hash": "144210568660760801636726603835706051231",
            "length": 4180.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ad898ae82412f8a689d59829804bff2999dd0ea"
    },
    {
        "id": "CVE-2024-45006-cda6ab02",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/usb/host/xhci.c"
        },
        "digest": {
            "line_hashes": [
                "210966616992933520195664822169564418792",
                "123601029581175945132436134825233379173",
                "47258318678105498326729895361288483563",
                "163732246781869669465312481195422408302",
                "276885728956560951269646999171224759014",
                "273283285174845624787254295496525864770",
                "245455610987120693830633323164821980777",
                "64999428298168307695603386161149767116",
                "283071947695599903696547033201778125550"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ad898ae82412f8a689d59829804bff2999dd0ea"
    },
    {
        "id": "CVE-2024-45006-d9717573",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_setup_device"
        },
        "digest": {
            "function_hash": "144210568660760801636726603835706051231",
            "length": 4180.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af8e119f52e9c13e556be9e03f27957554a84656"
    },
    {
        "id": "CVE-2024-45006-e9014b9f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_configure_endpoint"
        },
        "digest": {
            "function_hash": "41289104816877985060921168020139424065",
            "length": 2070.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b99de301d78e1f5249e57ef2c32e1dec3df2bb1"
    },
    {
        "id": "CVE-2024-45006-ed62fd90",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/usb/host/xhci.c",
            "function": "xhci_setup_device"
        },
        "digest": {
            "function_hash": "237292673069119558263354761395263383730",
            "length": 4134.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f0654318e25b2c185e245ba4a591e42fabb5e59"
    },
    {
        "id": "CVE-2024-45006-f57a5d50",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/usb/host/xhci.c"
        },
        "digest": {
            "line_hashes": [
                "210966616992933520195664822169564418792",
                "123601029581175945132436134825233379173",
                "47258318678105498326729895361288483563",
                "163732246781869669465312481195422408302",
                "276885728956560951269646999171224759014",
                "273283285174845624787254295496525864770",
                "245455610987120693830633323164821980777",
                "64999428298168307695603386161149767116",
                "283071947695599903696547033201778125550"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef0a0e616b2789bb804a0ce5e161db03170a85b6"
    }
]