Security readout for executives and security teams
Plain-English summary
This Linux kernel issue concerns a USB gadget mass-storage code path that can trigger a kernel warning when an endpoint is disabled by another thread. The source says there is no driver function failure, and the fix lowers the warning to debug logging. Business urgency appears low unless your products rely on Linux USB gadget functionality.
Executive priority
Treat as low priority for general server fleets, but include it in normal kernel patch cycles. Raise priority for embedded products, appliances, or lab systems that expose Linux USB gadget mass-storage behavior.
Technical view
CVE-2024-35822 is in the Linux USB gadget UDC core. The mass-storage function may queue a request while another thread has disabled the endpoint, causing a WARN_ON_ONCE in usb_ep_queue. Upstream stable commits resolve it by changing that warning to pr_debug, based on the stated absence of driver failure.
Likely exposure
Exposure is most plausible on Linux systems using USB gadget/UDC mass-storage functionality, often embedded or device-style deployments. The bundle lists Linux as affected across several kernel version lines, but does not provide CPEs, CVSS, or a complete product matrix.
Exploitation context
The bundle does not cite active exploitation, public exploit use, or CISA KEV listing. The described impact is a warning condition, not confirmed code execution, privilege escalation, data loss, or service failure.
Researcher notes
Evidence is narrow: the CVE text states the warning can be triggered but also says no driver failure occurs. No CWE, CVSS, CPEs, or exploitation evidence are provided. Avoid broad impact claims without vendor-specific advisories.
Mitigation direction
- Apply vendor or distribution kernel updates containing the referenced stable commits.
- Prioritize systems that use Linux USB gadget or mass-storage device functionality.
- For Debian LTS systems, review the cited Debian LTS advisories.
- If updates are unavailable, follow your kernel vendor guidance.
- Track future CVE updates because severity and CVSS are absent here.
Validation and detection
- Inventory Linux kernel versions on systems with USB gadget functionality.
- Check whether the running kernel includes the referenced upstream stable fix.
- Review distro security advisories for package-level backports.
- Look for historical usb_ep_queue WARN_ON messages in kernel logs.
- Confirm whether USB mass-storage gadget code is enabled or used.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 2b002c308e18
- Linux stable commit 68d951880d0c
- Linux stable commit 3e944ddc17c0
- Linux stable commit df5cbb908f16
- Linux stable commit f74c5e0b54b0
- Linux stable commit 99731076722e
- Linux stable commit 36177c2595df
- Linux stable commit 30511676eb54
- Linux stable commit 2a587a035214
- Debian LTS advisory
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35822 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2b002c308e184feeaeb72987bca3f1b11e5f70b8CVE reference, Linux
- https://git.kernel.org/stable/c/68d951880d0c52c7f13dcefb5501b69b8605ce8cCVE reference, Linux
- https://git.kernel.org/stable/c/3e944ddc17c042945d983e006df7860687a8849aCVE reference, Linux
- https://git.kernel.org/stable/c/df5cbb908f1687e8ab97e222a16b7890d5501acfCVE reference, Linux
- https://git.kernel.org/stable/c/f74c5e0b54b02706d9a862ac6cddade30ac86bcfCVE reference, Linux
- https://git.kernel.org/stable/c/99731076722eb7ed26b0c87c879da7bb71d24290CVE reference, Linux
- https://git.kernel.org/stable/c/36177c2595df12225b95ce74eb1ac77b43d5a58cCVE reference, Linux
- https://git.kernel.org/stable/c/30511676eb54d480d014352bf784f02577a10252CVE reference, Linux
- https://git.kernel.org/stable/c/2a587a035214fa1b5ef598aea0b81848c5b72e5eCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.