CVE-2024-26748 is a vulnerability identified in the Linux kernel's USB gadget driver for Cadence USB3 (cdns3). The flaw arises due to a double free of memory when handling zero-length packets (ZLPs) during USB data transfers. Specifically, the driver appends an additional zero-length packet request when queuing a packet whose length is a multiple of the maximum packet size. Upon transfer completion, the function usb_gadget_giveback_request() frees this request. However, the driver then erroneously frees the same request again via cdns3_gadget_ep_free_request(), resulting in a double free condition. This double free can lead to use-after-free reads, as evidenced by kernel fault logs showing KFENCE (Kernel Electric Fence) detecting use-after-free reads in the cdns3_gadget_giveback function. The root cause is the lack of a check to skip the usb_gadget_giveback_request() call for the additional zero-length packet request, which is allocated internally by the driver and should not be freed twice. The patch involves adding a conditional check to prevent this double free by skipping the call to usb_gadget_giveback_request() for the additional zero-length packet request. This vulnerability affects Linux kernel versions containing the affected commit hashes referenced, and it is relevant to systems using the cdns3 USB gadget driver, typically embedded or specialized devices using Cadence USB3 controllers. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

The vulnerability can cause kernel memory corruption due to double free and use-after-free conditions, potentially leading to system instability, crashes (kernel panics), or denial of service (DoS). In worst-case scenarios, an attacker with the ability to send crafted USB packets to a vulnerable device could exploit this flaw to execute arbitrary code within the kernel context, escalating privileges or compromising system integrity. For European organizations, the impact is significant especially for those relying on Linux-based embedded systems, IoT devices, or specialized hardware using the cdns3 USB gadget driver. Such devices are common in industrial control systems, telecommunications infrastructure, and network appliances. Disruption or compromise of these systems could affect critical infrastructure, data confidentiality, and operational continuity. Additionally, the vulnerability could be leveraged in targeted attacks against organizations with physical or remote USB access to vulnerable devices. However, exploitation requires specific conditions such as access to the USB gadget interface, which may limit the attack surface to local or physically proximate attackers.

Organizations should promptly apply the Linux kernel patches that address CVE-2024-26748 once available from their Linux distribution vendors or kernel maintainers. For systems where immediate patching is not feasible, mitigating controls include disabling or restricting USB gadget functionality if not required, or limiting physical and logical access to USB interfaces on vulnerable devices. Monitoring kernel logs for unusual USB gadget driver errors or kernel faults can help detect exploitation attempts. Additionally, organizations should implement strict device control policies to prevent unauthorized USB device connections. For embedded and IoT devices, firmware updates incorporating the patched kernel should be prioritized. Security teams should also conduct asset inventories to identify devices using the cdns3 driver and assess exposure. Network segmentation and isolation of critical devices can reduce the risk of lateral movement if exploitation occurs.