CVE-2024-27405 is a high-severity vulnerability in the Linux kernel's USB gadget subsystem, specifically affecting the Network Control Model (NCM) implementation used for USB tethering scenarios. The vulnerability arises due to improper handling of Network Transfer Blocks (NTBs) when tethering with Windows 11 hosts. In certain cases, the Linux kernel's gadget driver receives NTBs with an extra byte appended, which leads to the parsing logic incorrectly interpreting leftover bytes as a separate NTB. If this second NTB is malformed or corrupt, the driver discards all previously parsed datagrams stored in the receive list (rx_list), resulting in dropped network packets. This behavior stems from a mismatch in expectations between Windows drivers and Linux gadget drivers regarding Zero Length Packets (ZLP) and block length handling. Windows drivers omit ZLPs when wBlockLength is non-zero, while some NCM devices expect ZLP padding if wBlockLength is a multiple of wMaxPacketSize. To accommodate these devices, Windows pads an extra zero byte, which triggers the Linux kernel's parsing issue. The consequence is a denial of service (DoS) condition where valid network data is lost during tethering, impacting connectivity and availability. The vulnerability does not affect confidentiality or integrity but severely impacts availability of network communication over USB tethering. Exploitation requires no privileges or user interaction and can be triggered remotely by connecting a Windows 11 host to a vulnerable Linux gadget device. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability. No known exploits are reported in the wild yet. The root cause relates to improper null pointer dereference handling (CWE-476) in the USB gadget NCM code path. The issue has been resolved in recent Linux kernel updates by improving NTB parsing robustness and avoiding dropping properly parsed datagrams when leftover bytes are detected.

For European organizations, this vulnerability primarily impacts devices running Linux kernels with USB gadget NCM support used in tethering scenarios, such as embedded systems, IoT devices, or network appliances that rely on USB tethering with Windows 11 hosts. The main impact is denial of service due to dropped network packets, which can disrupt critical communications, remote management, or data transfer operations. This can affect sectors relying on stable network connectivity including telecommunications, manufacturing, healthcare, and public services. While the vulnerability does not expose data to unauthorized access or modification, the availability degradation can cause operational interruptions and potential financial losses. Organizations using Linux-based network gateways or USB tethering as fallback connectivity in remote or mobile deployments may experience intermittent connectivity failures. The lack of required privileges or user interaction for exploitation increases the risk in environments where Windows 11 hosts connect to Linux gadgets. However, the impact is limited to network availability and does not extend to system compromise or data breaches.

1. Update Linux kernels to the latest stable versions where the patch for CVE-2024-27405 is applied, ensuring the USB gadget NCM code correctly handles leftover bytes without dropping valid datagrams. 2. For embedded or IoT devices with limited update capabilities, consider disabling USB gadget NCM functionality if tethering is not required or use alternative tethering methods. 3. Implement network monitoring to detect unusual packet loss or tethering failures that may indicate attempts to exploit this vulnerability. 4. Educate IT and security teams about the issue to avoid using Windows 11 hosts for tethering with vulnerable Linux devices until patches are applied. 5. For critical deployments, test tethering scenarios with patched kernels in controlled environments before production rollout. 6. Collaborate with device vendors to ensure timely firmware and kernel updates addressing this vulnerability. 7. Employ endpoint security controls on Windows 11 hosts to restrict unauthorized USB connections to Linux gadgets where feasible.