CVE-2024-45006

A vulnerability was found in the Linux kernel, which involves a NULL pointer dereference in the xHCI driver during full-speed USB device enumeration. When a failed address device command occurs, the xhci_virt_device structure is allocated, but its bandwidth table pointers are not properly initialized. This issue leads to a NULL pointer dereference the next time usb_ep0_reinit() is called.

This issue is classified as Moderate severity rather than Important because it specifically affects the handling of full-speed USB device enumeration under conditions where the address device command fails. The NULL pointer dereference occurs during the re-enumeration process and primarily impacts systems under specific failure scenarios. While it can lead to kernel crashes, the impact is limited to certain USB enumeration situations and does not affect the majority of typical device operations or the overall system stability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.