Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2024-53205: Linux kernel can crash on Realtek USB device detection
CVE-2024-53205 · published 1 year ago
Summary
The core Linux operating system may stop working if a Realtek USB controller is initialized and the system runs out of memory. This happens because the code does not verify that memory was successfully allocated before using it. Updating to a kernel version that includes the fix or applying the provided patch will prevent the crash.
What to do
- Update debian linux to version 6.12.3-1.
- Update linux kernel to version 6.12.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 6.6, < 6.11.11 >= 6.12, < 6.12.2 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Debian:13 | debian | linux |
< 6.12.3-1 Fix: upgrade to 6.12.3-1
|
| Linux | linux | kernel |
>= 6.12.0, < 6.12.2 Fix: upgrade to 6.12.2
|
Original advisory text
phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe
In the Linux kernel, the following vulnerability has been resolved: phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe In rtk_usb2phy_probe() devm_kzalloc() may return NULL but this returned value is not checked.
References
- https://git.kernel.org/stable/c/04e3e9188291a183b27306ddb833722c0d083d6a URL
- https://git.kernel.org/stable/c/0b398b6b6c94315fd2ce3658e3cee96539dbd7b7 URL
- https://git.kernel.org/stable/c/7a784bcdd7e54f0599da3b2360e472238412623e URL
- https://git.kernel.org/stable/c/7e2cde1813418b39b5e95d86e10d6701dccf18af URL
- https://git.kernel.org/stable/c/fb83c9a08324e37f321ffb400809aa4310387d65 URL
- https://security-tracker.debian.org/tracker/CVE-2024-53205 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53205... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-53205 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-476NULL Pointer Dereference
Timeline
Published27 Dec 2024
Updated3 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta