CVE-2024-41097

A flaw was found in the Linux kernel's cxacru USB driver. Improper validation of USB communication endpoints during device connection allows an attacker capable of connecting or emulating a malicious USB device to supply unexpected endpoint configurations. This issue causes the driver to submit invalid transfer requests, potentially leading to a system crash and a Denial of Service (DoS).

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires physical access to attach a malicious USB device or the ability to emulate USB hardware in a virtualized guest environment. In standard enterprise and cloud server deployments, legacy Conexant AccessRunner USB ADSL hardware is rarely present or configured. Successful exploitation triggers an invalid transfer request in the kernel that causes a denial of service through a system crash, without directly compromising data confidentiality or system integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.