CVE-2024-35790

A flaw was found in the Linux kernel's USB Type-C DisplayPort alternate mode driver. This vulnerability can lead to a Denial of Service (DoS) due to a race condition during device initialization. The driver exposes device control files in the sysfs virtual file system before completing its internal data setup. A local user can exploit this flaw by reading these files while a device is being registered, triggering a null pointer dereference that crashes the operating system.

This vulnerability is rated with a Low severity because exploiting it requires an unprivileged local user to win a tight race condition during the connection or initialization of a physical USB Type-C DisplayPort alternate mode peripheral. Standard enterprise server environments rarely utilize USB Type-C DisplayPort devices, significantly limiting practical exposure. Successful exploitation leads solely to a denial of service via a kernel null-pointer dereference crash, with no threat to system data integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.