Linux Kernel NULL Pointer Dereference Vulnerability in USB XHCI Component

A NULL pointer dereference vulnerability has been identified in the Linux kernel's USB xHCI (eXtensible Host Controller Interface) component. This issue arises when a command is queued to the last usable Transfer Request Block (TRB) of a ring segment. The enqueue pointer is then moved to the next link TRB, and no further commands can be queued. If this command is later aborted, the handling of the abort completion advances the dequeue pointer to the first TRB of the following segment. If no additional commands are queued, the xhci_handle_stopped_cmd_ring() function detects an inequality in the ring pointers and assumes a command is still pending. This leads to a call to xhci_mod_cmd_timer(), which causes a crash if the current command pointer (cur_cmd) is NULL. The vulnerability has been independently reproduced and confirmed fixed using a USB microcontroller unit (MCU) programmed to indefinitely NAK (negative acknowledgment) the Status stage of the SET_ADDRESS command, preventing several crashes that would have otherwise occurred.

Impact

Exploitation of this vulnerability leads to a system crash due to a NULL pointer dereference.