The Linux kernel usbip subsystem contained a long-standing NULL pointer dereference vulnerability in the vep_dequeue() function. This was due to vep_alloc_request() failing to initialize the vrequest->udc pointer, which led to cancellations arriving without a valid UDC reference on the FunctionFS AIO path. The patch removes the unused vrequest->udc field and modifies vep_dequeue() to obtain the UDC reference correctly via ep_to_vudc(), aligning with other vep operations. Testing showed that before the fix, attaching usbip devices could cause kernel oopses with a specific backtrace. This vulnerability has been resolved in the Linux kernel.

The vulnerability could cause kernel crashes (NULL pointer dereference) when using usbip with FunctionFS AIO endpoints, potentially leading to denial of service on affected systems. There is no indication of privilege escalation or code execution. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a kernel version that includes this patch to prevent kernel crashes related to usbip FunctionFS AIO operations. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.