CVE-2024-36894 is a medium severity vulnerability in the Linux kernel's USB gadget subsystem, specifically affecting the FunctionFS (FFS) implementation used in USB device emulation. The vulnerability arises from a race condition between asynchronous I/O (AIO) cancellation and completion handling within the USB gadget driver stack. In detail, when an FFS-based application issues an aio_cancel() call to dequeue pending USB requests submitted to the USB Device Controller (UDC), a race can occur if the UDC is simultaneously handling a soft disconnect event. The affected code path involves the DWC3 USB controller driver, where the soft disconnect triggers stopping active transfers and completing USB requests with an error status. The problem is that the completion handler frees the USB request structure (io_data->req) without proper synchronization against concurrent aio_cancel() calls that attempt to dequeue the same request. This leads to a use-after-free or stale pointer dereference scenario, which can cause kernel crashes or undefined behavior. The root cause is the lack of locking between the AIO completion handler and the AIO cancel routine. Attempts to add locking directly to the completion handler were avoided due to potential deadlocks, as the completion handler may invoke the function driver's completion callback in the same context. The fix implemented moves the usb_ep_free_request() call back to a worker context (ffs_user_copy_worker()) and ensures that the freed request pointer is set to NULL within a spinlock-protected section. This prevents the aio_cancel() routine from accessing freed memory and resolves the race condition. The vulnerability is tracked under CWE-362 (Race Condition) and has a CVSS v3.1 base score of 5.6, reflecting a medium severity with high impact on confidentiality and availability but requiring physical or local access (AV:P) and high attack complexity (AC:H). No known exploits are currently reported in the wild. The vulnerability affects Linux kernel versions containing the specified commit hashes prior to the fix and is relevant for systems using USB gadget FunctionFS with DWC3 controllers, commonly found in embedded devices and development boards running Linux.

For European organizations, the impact of CVE-2024-36894 depends largely on their use of Linux-based embedded systems or devices that utilize the USB gadget FunctionFS framework, particularly those employing DWC3 USB controllers. Such devices are common in industrial control systems, IoT gateways, telecom equipment, and development platforms. Exploitation of this race condition can lead to kernel crashes (denial of service) or potentially enable local privilege escalation or information leakage through memory corruption, impacting system availability and confidentiality. Organizations relying on Linux-based embedded devices for critical infrastructure or operational technology may face service disruptions or require costly incident response and device replacement. However, the attack vector requires local or physical access to the device (attack vector: physical), and the attack complexity is high, limiting remote exploitation risks. The vulnerability does not require user interaction but does require at least low privileges on the device. Therefore, the threat is more significant in environments where untrusted users or processes have local access to vulnerable devices. European sectors such as manufacturing, energy, telecommunications, and research institutions using Linux embedded devices should assess their exposure. The absence of known exploits reduces immediate risk, but timely patching is recommended to prevent future exploitation.

1. Apply the official Linux kernel patches that address CVE-2024-36894 as soon as they become available from trusted Linux distribution vendors or upstream kernel sources. 2. For embedded devices or custom Linux builds, rebuild and deploy updated kernel images incorporating the fix. 3. Restrict local access to devices running vulnerable Linux kernels, especially limiting unprivileged user access to USB gadget interfaces. 4. Implement strict access controls and monitoring on devices that expose USB gadget FunctionFS interfaces to detect abnormal AIO cancellation or USB disconnect events. 5. Where possible, disable unused USB gadget functions or interfaces to reduce the attack surface. 6. Employ kernel lockdown features or mandatory access controls (e.g., SELinux, AppArmor) to limit the ability of local users to perform operations that could trigger this race condition. 7. Conduct thorough testing of USB gadget functionality after patching to ensure stability and no regressions. 8. Maintain an inventory of devices using DWC3 USB controllers and FunctionFS to prioritize patching and risk assessment. 9. Educate system administrators and embedded device maintainers about the vulnerability and the importance of applying updates promptly.