Linux Kernel NULL Pointer Dereference Vulnerability in USB XHCI Platform Driver

A vulnerability in the Linux kernel's USB XHCI platform driver can lead to a NULL pointer dereference. This issue arises because the 'shared_hcd' field can be NULL, causing a kernel crash (referred to as an 'Oops' error) during the removal of the USB host controller. The vulnerability has been observed in the 5.19.0-rc7 kernel version.

Impact

Exploitation of this vulnerability causes a kernel NULL pointer dereference, leading to a system crash.

Reproduction

The vulnerability can be reproduced by triggering a system shutdown while the USB XHCI platform driver is active. This can be done by disconnecting USB devices or deregistering USB buses, which will cause the driver to attempt to remove the host controller. If 'shared_hcd' is NULL, the removal process will attempt to access a NULL pointer, causing a kernel crash.