Security readout for executives and security teams
Plain-English summary
CVE-2024-41035 is a Linux kernel USB handling flaw. A malformed USB endpoint descriptor can make the kernel treat duplicate endpoints as different, creating internal confusion. The public record does not provide CVSS, confirmed impact, or active exploitation evidence.
Executive priority
Handle through normal kernel patch management, with higher priority where untrusted USB devices are common. There is no provided evidence of active exploitation, but kernel USB parsing bugs can matter operationally because they sit below application controls.
Technical view
Linux usbcore assumed reserved bits in bEndpointAddress were zero. When they were not cleared during parsing, endpoint_is_duplicate() could miss duplicate endpoint number and direction pairs. The resolved fix clears reserved bits while parsing copied endpoint descriptors.
Likely exposure
Exposure is most relevant to Linux systems that accept untrusted USB devices or USB passthrough into kernels using affected Linux versions. The source bundle lists Linux as affected and points to stable kernel fixes, but exact distro package exposure requires vendor mapping.
Exploitation context
The bundle cites syzbot discovery and kernel stable fixes. It does not cite KEV listing, public exploitation, exploit availability, or a complete impact statement. Treat active exploitation as not evidenced by the provided sources.
Researcher notes
Focus review on usb_parse_endpoint(), endpoint descriptor copying, bEndpointAddress reserved-bit masking, and duplicate endpoint detection. The source evidence supports malformed descriptor confusion, not broader impacts beyond what the kernel fix text describes.
Mitigation direction
- Update to a Linux kernel containing the referenced stable usbcore fixes.
- Use distribution security updates where available, including Debian LTS guidance if applicable.
- Restrict physical or virtual USB device attachment on sensitive Linux systems.
- Review vendor advisories for exact fixed package versions.
- Avoid direct wrangler or deployment actions unrelated to kernel remediation.
Validation and detection
- Inventory Linux kernel versions on systems that can receive USB devices.
- Map running kernels to vendor advisories or the referenced stable commits.
- Confirm distro packages include the usbcore reserved-bit clearing fix.
- Review USB passthrough exposure in virtualization and appliance environments.
- Prioritize systems with public kiosks, labs, or unmanaged peripheral access.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit d8418fd083d1
- Linux stable commit 60abea505b72
- Linux stable commit d09dd21bb521
- Linux stable commit 2bd8534a1b83
- Linux stable commit 9edcf317620d
- Linux stable commit 647d61aef106
- Linux stable commit 37514a5c1251
- Linux stable commit a368ecde8a50
- Debian LTS announcement
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-41035 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d8418fd083d1b90a6c007cf8dcf81aeae274727bCVE reference, Linux
- https://git.kernel.org/stable/c/60abea505b726b38232a0ef410d2bd1994a77f78CVE reference, Linux
- https://git.kernel.org/stable/c/d09dd21bb5215d583ca9a1cb1464dbc77a7e88cfCVE reference, Linux
- https://git.kernel.org/stable/c/2bd8534a1b83c65702aec3cab164170f8e584188CVE reference, Linux
- https://git.kernel.org/stable/c/9edcf317620d7c6a8354911b69b874cf89716646CVE reference, Linux
- https://git.kernel.org/stable/c/647d61aef106dbed9c70447bcddbd4968e67ca64CVE reference, Linux
- https://git.kernel.org/stable/c/37514a5c1251a8c5c95c323f55050736e7069ac7CVE reference, Linux
- https://git.kernel.org/stable/c/a368ecde8a5055b627749b09c6218ef793043e47CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.