Security readout for executives and security teams
Plain-English summary
CVE-2024-36896 is a Linux kernel USB bug where concurrent USB hub removal can leave code using a missing hub object. The public record rates it critical, but the description points to a race in USB port disable read/write handling, not a business-application flaw. Prioritize kernel patch verification on Linux systems that expose USB hardware or port-management paths.
Executive priority
Treat as high-priority kernel hygiene because the public severity is critical and impact includes integrity and availability. Urgency is strongest for Linux fleets with USB exposure or untrusted users. Active exploitation is not shown in the provided sources, so prioritize measured patch rollout over emergency assumptions.
Technical view
The bug is a NULL pointer dereference in USB core port.c disable_store() and disable_show(). usb_hub_to_struct_hub() can return NULL during concurrent hub removal, and the old code dereferenced it. Stable fixes remove an unnecessary dereference and add a NULL check. The source maps this to CWE-476 and CVSS 3.1 score 9.1.
Likely exposure
Linux systems running affected kernel versions are potentially exposed, especially where USB hubs/devices can be removed while port disable state is accessed. The source data lists Linux 6.0 through fixed stable lines including 6.1.91, 6.6.31, 6.8.10, and 6.9, but distro backports require vendor-specific checking.
Exploitation context
The bundle does not cite active exploitation, and KEV is false. The CVSS vector says network and unauthenticated, but the technical description centers on USB core device-removal concurrency. Treat internet exploitability as unproven from these sources and validate against kernel and vendor advisories.
Researcher notes
The public description supports a race-triggered NULL dereference in USB port disable paths. The CVSS vector appears broader than the technical narrative; do not assume remote exploitation without additional vendor evidence. Review the stable commits and downstream backports to identify exact fixed build provenance.
Mitigation direction
- Update affected Linux kernels to builds containing the referenced stable fixes.
- Check distribution advisories for backported CVE-2024-36896 fixes.
- Prioritize hosts with physical or virtual USB device churn.
- Restrict untrusted USB access where operationally feasible until patched.
- Avoid relying only on upstream version strings for distro kernels.
Validation and detection
- Inventory Linux kernel versions across servers, endpoints, and appliances.
- Map installed kernels to vendor advisories for CVE-2024-36896.
- Confirm patched builds include the referenced USB core commits or backports.
- Review exposure on systems with accessible USB ports or passthrough.
- Track remediation evidence in vulnerability management records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-36896 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H3.95.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5f1d68ef5ddac27c6b997adccd1c339cef1e6848CVE reference, Linux
- https://git.kernel.org/stable/c/63533549ff53d24daf47c443dbd43c308afc3434CVE reference, Linux
- https://git.kernel.org/stable/c/6119ef6517ce501fc548154691abdaf1f954a277CVE reference, Linux
- https://git.kernel.org/stable/c/a4b46d450c49f32e9d4247b421e58083fde304ceCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.