CVE-2024-27001: Linux vulnerability

CVE-2024-27001: comedi: vmk80xx: fix incomplete endpoint checking

In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix incomplete endpoint checking While vmk80xx does have endpoint checking implemented, some things can fall through the cracks. Depending on the hardware model, URBs can have either bulk or interrupt type, and current version of vmk80xx_find_usb_endpoints() function does not take that fully into account. While this warning does not seem to be too harmful, at the very least it will crash systems with 'panic_on_warn' set on them. Fix the issue found by Syzkaller [1] by somewhat simplifying the endpoint checking process with usb_find_common_endpoints() and ensuring that only expected endpoint types are present. This patch has not been tested on real hardware. [1] Syzkaller report: usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 781 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x520 drivers/usb/core/message.c:59 vmk80xx_reset_device drivers/comedi/drivers/vmk80xx.c:227 [inline] vmk80xx_auto_attach+0xa1c/0x1a40 drivers/comedi/drivers/vmk80xx.c:818 comedi_auto_config+0x238/0x380 drivers/comedi/drivers.c:1067 usb_probe_interface+0x5cd/0xb00 drivers/usb/core/driver.c:399 ... Similar issue also found by Syzkaller:

UnknownCVSS not scoredNot KEV-listedUpdatedMay 11, 2026, 20:08 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel driver bug in vmk80xx COMEDI USB device handling. A malformed or unexpected USB endpoint layout can trigger kernel warnings; systems configured to panic on warnings may crash. Sources do not show data theft, privilege escalation, or internet-exposed exploitation.

Executive priority

Prioritize as a targeted availability issue, not a broad emergency. Patch during normal kernel maintenance unless affected systems rely on USB data-acquisition hardware, allow untrusted USB attachment, or use panic_on_warn in production.

Technical view

The vmk80xx driver incompletely validated USB endpoint types. Depending on hardware model, URBs may be bulk or interrupt, and mismatches reached usb_submit_urb, producing warnings found by Syzkaller. The fix uses common endpoint discovery and rejects unexpected endpoint types.

Likely exposure

Exposure appears limited to Linux systems using affected kernel versions with the comedi vmk80xx USB driver reachable through relevant USB device attachment paths. Cloud or remote-only systems are less likely exposed unless USB passthrough or local device attachment is in scope.

Exploitation context

The bundle does not show KEV listing or active exploitation. Evidence describes Syzkaller-triggered warnings and possible crashes on systems with panic_on_warn enabled. No public exploit status is cited in the provided sources.

Researcher notes

The strongest evidence is the kernel fix description and Syzkaller trace. The patch was noted as not tested on real hardware. Impact details, CVSS, CWE, and exploitability are incomplete in the bundle, so validation should focus on kernel version, driver reachability, and local USB threat model.

Mitigation direction

Update to a kernel containing the vmk80xx endpoint-checking fix.
Apply relevant distribution kernel security updates, including Debian LTS where applicable.
Review vendor kernel advisories for your exact distribution and kernel branch.
Restrict untrusted USB device attachment on sensitive Linux systems.
Avoid panic_on_warn on systems where warning-triggered crashes are unacceptable.

Validation and detection

Inventory Linux hosts running affected kernel versions listed in the CVE bundle.
Check whether comedi and vmk80xx driver support is present or loadable.
Confirm deployed kernels include one of the referenced stable fixes.
Review logs for vmk80xx, usb_submit_urb, or BOGUS urb xfer warnings.
Verify distribution advisory status for managed Debian LTS systems.

Prepared: Jun 1, 2026, 15:57 UTC (UTC+00:00)
Confidence: medium
Sources: 12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-27001 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: May 1, 2024, 05:28 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

2ADP providers

14Source links

SSVC decision data

Timestamp: Jul 17, 2024, 14:56 UTC (UTC+00:00)
Version: 2.0.3

Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Feb 19, 2024, 14:20 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
May 1, 2024, 05:28 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
May 11, 2026, 20:08 UTC (UTC+00:00)

ADP provider summaries

other:ssvc

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/3a63ae0348d990e137cca04eced5b08379969ea9CVE reference, Linux
https://git.kernel.org/stable/c/a3b8ae7e9297dd453f2977b011c5bc75eb20e71bCVE reference, Linux
https://git.kernel.org/stable/c/f15370e315976198f338b41611f37ce82af6cf54CVE reference, Linux
https://git.kernel.org/stable/c/b0b268eeb087e324ef3ea71f8e6cabd07630517fCVE reference, Linux
https://git.kernel.org/stable/c/ac882d6b21bffecb57bcc4486701239eef5aa67bCVE reference, Linux
https://git.kernel.org/stable/c/59f33af9796160f851641d960bd93937f282c696CVE reference, Linux
https://git.kernel.org/stable/c/6ec3514a7d35ad9cfab600187612c29f669069d2CVE reference, Linux
https://git.kernel.org/stable/c/d1718530e3f640b7d5f0050e725216eab57a85d8CVE reference, Linux
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/CVE reference, CVE
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/CVE reference, CVE
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/CVE reference, CVE

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinux49253d542cc0f5f771dc254d248162a2a666649d, 49253d542cc0f5f771dc254d248162a2a666649d, 49253d542cc0f5f771dc254d248162a2a666649d, 49253d542cc0f5f771dc254d248162a2a666649d, 49253d542cc0f5f771dc254d248162a2a666649d, 49253d542cc0f5f771dc254d248162a2a666649d, 49253d542cc0f5f771dc254d248162a2a666649d, 49253d542cc0f5f771dc254d248162a2a666649dunaffected

LinuxLinux3.9, 0, 4.19.313, 5.4.275, 5.10.216, 5.15.157, 6.1.88, 6.6.29, 6.8.8, 6.9affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.