CVE-2024-50075 is a vulnerability identified in the Linux kernel specifically affecting the Tegra XUSB controller's handling of USB2 port numbers when USB virtualization is enabled. The Tegra XUSB controller supports multiple USB2 physical ports (phys), and in virtualized environments, these ports are shared among all Virtual Functions (VFs). The vulnerability arises because the USB2 port number assigned to a USB2 root hub within a Virtual Function may be less than the total number of USB2 phys supported by the controller. However, the kernel code incorrectly uses the total number of USB2 phys as the port number to check all PORTSC (Port Status and Control) register values. This leads to out-of-bounds memory access, causing invalid memory reads or writes. The kernel logs indicate a kernel paging request failure at an invalid virtual address, followed by a call trace involving functions such as tegra_xusb_enter_elpg and tegra_xusb_runtime_suspend, which are related to power management and runtime suspend operations of the USB controller. This bug can cause kernel crashes (kernel panics) or instability due to invalid memory access during USB2 port status checks in virtualized environments. The vulnerability is specifically relevant to Linux kernel versions containing the affected commit (hash a30951d31b250bf3479c00e93646b6cc6fb42a56) and impacts systems using the Tegra XUSB controller with USB virtualization enabled. No known exploits are reported in the wild as of publication date (October 29, 2024), and no CVSS score has been assigned yet. The issue was reserved and published within a short timeframe, indicating a recent discovery and patching effort.

For European organizations, the impact of CVE-2024-50075 depends largely on the deployment of Linux systems running on Tegra-based hardware with USB virtualization enabled. Tegra processors are commonly used in embedded systems, automotive infotainment, industrial control, and edge computing devices. Organizations utilizing such devices in critical infrastructure, manufacturing, or automotive sectors could face system instability or denial of service due to kernel crashes triggered by this vulnerability. The invalid memory access could lead to kernel panics, causing downtime or interruption of services relying on affected hardware. While this vulnerability does not directly expose confidentiality or integrity risks, the availability impact could be significant in environments where uptime is critical. Additionally, since the issue occurs during runtime suspend and power management operations, it could affect power efficiency and device reliability. The lack of known exploits reduces immediate risk, but unpatched systems remain vulnerable to potential future exploitation. European organizations with embedded Linux devices in sectors such as automotive manufacturing, industrial automation, telecommunications, and IoT deployments should prioritize assessment and remediation to avoid operational disruptions.

1. Apply the official Linux kernel patch that fixes the USB2 port number checking logic in the Tegra XUSB driver as soon as it becomes available from trusted Linux kernel sources or vendor distributions. 2. For organizations using Tegra-based embedded systems, coordinate with hardware vendors and device manufacturers to obtain firmware or kernel updates incorporating the fix. 3. If patching is not immediately possible, consider disabling USB virtualization features on affected devices to prevent the vulnerability from being triggered, understanding this may reduce functionality. 4. Implement monitoring for kernel logs and system stability indicators to detect early signs of kernel panics or memory access errors related to USB operations. 5. Conduct thorough testing of updated kernels in staging environments before deployment to avoid regressions in power management or USB functionality. 6. Maintain an inventory of devices using Tegra XUSB controllers and USB virtualization to prioritize patching efforts. 7. Engage with Linux distribution security teams and subscribe to security advisories to receive timely updates on this and related vulnerabilities. 8. For critical infrastructure, consider network segmentation and access controls to limit exposure of vulnerable devices to untrusted networks or users.