CVE-2024-50075 (GCVE-0-2024-50075)

Vulnerability from cvelistv5 – Published: 2024-10-29 00:50 – Updated: 2026-08-05 11:41
VLAI
Title
xhci: tegra: fix checked USB2 port number
Summary
In the Linux kernel, the following vulnerability has been resolved: xhci: tegra: fix checked USB2 port number If USB virtualizatoin is enabled, USB2 ports are shared between all Virtual Functions. The USB2 port number owned by an USB2 root hub in a Virtual Function may be less than total USB2 phy number supported by the Tegra XUSB controller. Using total USB2 phy number as port number to check all PORTSC values would cause invalid memory access. [ 116.923438] Unable to handle kernel paging request at virtual address 006c622f7665642f ... [ 117.213640] Call trace: [ 117.216783] tegra_xusb_enter_elpg+0x23c/0x658 [ 117.222021] tegra_xusb_runtime_suspend+0x40/0x68 [ 117.227260] pm_generic_runtime_suspend+0x30/0x50 [ 117.232847] __rpm_callback+0x84/0x3c0 [ 117.237038] rpm_suspend+0x2dc/0x740 [ 117.241229] pm_runtime_work+0xa0/0xb8 [ 117.245769] process_scheduled_works+0x24c/0x478 [ 117.251007] worker_thread+0x23c/0x328 [ 117.255547] kthread+0x104/0x1b0 [ 117.259389] ret_from_fork+0x10/0x20 [ 117.263582] Code: 54000222 f9461ae8 f8747908 b4ffff48 (f9400100)
Severity
8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:23 UTC
CWE
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6633 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a30951d31b250bf3479c00e93646b6cc6fb42a56 , < 9c696bf4ab54c7cec81221887564305f0ceeac0a (git)
Affected: a30951d31b250bf3479c00e93646b6cc6fb42a56 , < c46555f14b71f95a447f5d49fc3f1f80a1472da2 (git)
Affected: a30951d31b250bf3479c00e93646b6cc6fb42a56 , < 7d381137cb6ecf558ef6698c7730ddd482d4c8f2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.58 , ≤ 6.6.* (semver)
Unaffected: 6.11.5 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:23:31.784076Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:21.340Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-tegra.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c696bf4ab54c7cec81221887564305f0ceeac0a",
              "status": "affected",
              "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56",
              "versionType": "git"
            },
            {
              "lessThan": "c46555f14b71f95a447f5d49fc3f1f80a1472da2",
              "status": "affected",
              "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56",
              "versionType": "git"
            },
            {
              "lessThan": "7d381137cb6ecf558ef6698c7730ddd482d4c8f2",
              "status": "affected",
              "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-tegra.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.58",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.5",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: tegra: fix checked USB2 port number\n\nIf USB virtualizatoin is enabled, USB2 ports are shared between all\nVirtual Functions. The USB2 port number owned by an USB2 root hub in\na Virtual Function may be less than total USB2 phy number supported\nby the Tegra XUSB controller.\n\nUsing total USB2 phy number as port number to check all PORTSC values\nwould cause invalid memory access.\n\n[  116.923438] Unable to handle kernel paging request at virtual address 006c622f7665642f\n...\n[  117.213640] Call trace:\n[  117.216783]  tegra_xusb_enter_elpg+0x23c/0x658\n[  117.222021]  tegra_xusb_runtime_suspend+0x40/0x68\n[  117.227260]  pm_generic_runtime_suspend+0x30/0x50\n[  117.232847]  __rpm_callback+0x84/0x3c0\n[  117.237038]  rpm_suspend+0x2dc/0x740\n[  117.241229] pm_runtime_work+0xa0/0xb8\n[  117.245769]  process_scheduled_works+0x24c/0x478\n[  117.251007]  worker_thread+0x23c/0x328\n[  117.255547]  kthread+0x104/0x1b0\n[  117.259389]  ret_from_fork+0x10/0x20\n[  117.263582] Code: 54000222 f9461ae8 f8747908 b4ffff48 (f9400100)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The faulting path is the Tegra XUSB controller\u0027s runtime-PM autosuspend/system-suspend handler on the local SoC; there is no network, adjacent, or remote-peer data path into `tegra_xusb_enter_elpg()`, and no USB device needs to be attached since the loop runs precisely when all root-hub ports are already suspended.\nAC:L - On an affected platform (Tegra XUSB with USB virtualization, where a VF root hub reports fewer USB2 ports than `tegra-\u003enum_usb_phys`) the out-of-bounds index is taken deterministically on every ELPG entry \u2014 no race, no timing window, and the 2 s autosuspend guarantees it fires repeatedly during ordinary idle.\nPR:N - The out-of-bounds read and wild dereference happen inside `pm_runtime_work`/`tegra_xusb_runtime_suspend()` on a kernel workqueue, driven autonomously by the PM core when the controller goes idle; no account, capability, or namespace privilege gates the path in any way.\nUI:N - Autosuspend after the 2000 ms idle delay is initiated by the driver core itself, so the fault manifests with no victim action \u2014 no device plug, mount, or file access is required.\nS:U - The over-read and the resulting dereference are confined to the kernel heap and MMIO of the same kernel security authority; even in the virtualized Tegra case the guest driver\u0027s access stays within guest page tables/SMMU and crosses no hypervisor, IOMMU, or sandbox boundary.\nC:H - The loop reads slab bytes past the end of the `kcalloc`\u0027d `usb2_rhub.ports` array and then performs two chained dereferences at addresses the kernel never validated (`*(void **)p`, then `readl()`), an unbounded read from an uncontrolled kernel/MMIO address rather than a small fixed-size over-read, and the resulting value is partially observable through the per-port UTMI pad power state programmed at resume.\nI:L - No out-of-bounds write or control-flow primitive exists, but out-of-bounds-derived data directly sets `tegra-\u003elp0_utmi_pad_mask`, which `tegra_xhci_program_utmi_power_lp0_exit()` uses to power UTMI pads on/off, and the unvalidated `readl()` can strike read-to-clear registers of an unrelated device\u0027s MMIO, giving limited corruption of kernel and hardware state.\nA:H - The commit documents a hard kernel oops (\"Unable to handle kernel paging request at virtual address 006c622f7665642f\") in `tegra_xusb_enter_elpg+0x23c`, killing the PM worker while holding `tegra-\u003elock` so the controller can never suspend or resume again, and producing a full panic on `panic_on_oops` systems typical of automotive/embedded Tegra deployments."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:25.758Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c696bf4ab54c7cec81221887564305f0ceeac0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c46555f14b71f95a447f5d49fc3f1f80a1472da2"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d381137cb6ecf558ef6698c7730ddd482d4c8f2"
        }
      ],
      "title": "xhci: tegra: fix checked USB2 port number",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50075",
    "datePublished": "2024-10-29T00:50:17.304Z",
    "dateReserved": "2024-10-21T19:36:19.940Z",
    "dateUpdated": "2026-08-05T11:41:25.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50075",
      "date": "2026-10-09",
      "epss": "0.00218",
      "percentile": "0.11273"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "591A1F12-B1AF-4766-A668-EF6389C97C28",
                  "versionEndExcluding": "6.6.58",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6E62D61A-F704-44DB-A311-17B7534DA7BC",
                  "versionEndExcluding": "6.11.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: tegra: fix checked USB2 port number\n\nIf USB virtualizatoin is enabled, USB2 ports are shared between all\nVirtual Functions. The USB2 port number owned by an USB2 root hub in\na Virtual Function may be less than total USB2 phy number supported\nby the Tegra XUSB controller.\n\nUsing total USB2 phy number as port number to check all PORTSC values\nwould cause invalid memory access.\n\n[  116.923438] Unable to handle kernel paging request at virtual address 006c622f7665642f\n...\n[  117.213640] Call trace:\n[  117.216783]  tegra_xusb_enter_elpg+0x23c/0x658\n[  117.222021]  tegra_xusb_runtime_suspend+0x40/0x68\n[  117.227260]  pm_generic_runtime_suspend+0x30/0x50\n[  117.232847]  __rpm_callback+0x84/0x3c0\n[  117.237038]  rpm_suspend+0x2dc/0x740\n[  117.241229] pm_runtime_work+0xa0/0xb8\n[  117.245769]  process_scheduled_works+0x24c/0x478\n[  117.251007]  worker_thread+0x23c/0x328\n[  117.255547]  kthread+0x104/0x1b0\n[  117.259389]  ret_from_fork+0x10/0x20\n[  117.263582] Code: 54000222 f9461ae8 f8747908 b4ffff48 (f9400100)"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xhci: tegra: fix checked USB2 port number Si la virtualizaci\u00f3n USB est\u00e1 habilitada, los puertos USB2 se comparten entre todas las funciones virtuales. El n\u00famero de puerto USB2 que posee un concentrador ra\u00edz USB2 en una funci\u00f3n virtual puede ser menor que el n\u00famero total de puertos USB2 compatibles con el controlador Tegra XUSB. El uso del n\u00famero total de puertos USB2 como n\u00famero de puerto para verificar todos los valores PORTSC provocar\u00eda un acceso no v\u00e1lido a la memoria. [ 116.923438] No se puede manejar la solicitud de paginaci\u00f3n del n\u00facleo en la direcci\u00f3n virtual 006c622f7665642f ... [ 117.213640] Rastreo de llamadas: [ 117.216783] tegra_xusb_enter_elpg+0x23c/0x658 [ 117.222021] tegra_xusb_runtime_suspend+0x40/0x68 [ 117.227260] pm_generic_runtime_suspend+0x30/0x50 [ 117.232847] __rpm_callback+0x84/0x3c0 [ 117.237038] rpm_suspend+0x2dc/0x740 [ 117.241229] pm_runtime_work+0xa0/0xb8 [ 117.245769] proceso_trabajo_programado+0x24c/0x478 [ 117.251007] subproceso_trabajador+0x23c/0x328 [ 117.255547] kthread+0x104/0x1b0 [ 117.259389] ret_from_fork+0x10/0x20 [ 117.263582] C\u00f3digo: 54000222 f9461ae8 f8747908 b4ffff48 (f9400100)"
        }
      ],
      "id": "CVE-2024-50075",
      "lastModified": "2024-11-01T15:51:59.300",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-29T01:15:04.613",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/7d381137cb6ecf558ef6698c7730ddd482d4c8f2"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/9c696bf4ab54c7cec81221887564305f0ceeac0a"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/c46555f14b71f95a447f5d49fc3f1f80a1472da2"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-noinfo"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2025-01-29T00:00:00.000Z",
      "cve": "CVE-2024-50075",
      "id": "msrc_CVE-2024-50075",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "xhci: tegra: fix checked USB2 port number",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50075.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/host/xhci-tegra.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9c696bf4ab54c7cec81221887564305f0ceeac0a",
                    "status": "affected",
                    "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c46555f14b71f95a447f5d49fc3f1f80a1472da2",
                    "status": "affected",
                    "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7d381137cb6ecf558ef6698c7730ddd482d4c8f2",
                    "status": "affected",
                    "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/host/xhci-tegra.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.58",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "591A1F12-B1AF-4766-A668-EF6389C97C28",
                    "versionEndExcluding": "6.6.58",
                    "versionStartIncluding": "6.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6E62D61A-F704-44DB-A311-17B7534DA7BC",
                    "versionEndExcluding": "6.11.5",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: tegra: fix checked USB2 port number\n\nIf USB virtualizatoin is enabled, USB2 ports are shared between all\nVirtual Functions. The USB2 port number owned by an USB2 root hub in\na Virtual Function may be less than total USB2 phy number supported\nby the Tegra XUSB controller.\n\nUsing total USB2 phy number as port number to check all PORTSC values\nwould cause invalid memory access.\n\n[  116.923438] Unable to handle kernel paging request at virtual address 006c622f7665642f\n...\n[  117.213640] Call trace:\n[  117.216783]  tegra_xusb_enter_elpg+0x23c/0x658\n[  117.222021]  tegra_xusb_runtime_suspend+0x40/0x68\n[  117.227260]  pm_generic_runtime_suspend+0x30/0x50\n[  117.232847]  __rpm_callback+0x84/0x3c0\n[  117.237038]  rpm_suspend+0x2dc/0x740\n[  117.241229] pm_runtime_work+0xa0/0xb8\n[  117.245769]  process_scheduled_works+0x24c/0x478\n[  117.251007]  worker_thread+0x23c/0x328\n[  117.255547]  kthread+0x104/0x1b0\n[  117.259389]  ret_from_fork+0x10/0x20\n[  117.263582] Code: 54000222 f9461ae8 f8747908 b4ffff48 (f9400100)"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xhci: tegra: fix checked USB2 port number Si la virtualizaci\u00f3n USB est\u00e1 habilitada, los puertos USB2 se comparten entre todas las funciones virtuales. El n\u00famero de puerto USB2 que posee un concentrador ra\u00edz USB2 en una funci\u00f3n virtual puede ser menor que el n\u00famero total de puertos USB2 compatibles con el controlador Tegra XUSB. El uso del n\u00famero total de puertos USB2 como n\u00famero de puerto para verificar todos los valores PORTSC provocar\u00eda un acceso no v\u00e1lido a la memoria. [ 116.923438] No se puede manejar la solicitud de paginaci\u00f3n del n\u00facleo en la direcci\u00f3n virtual 006c622f7665642f ... [ 117.213640] Rastreo de llamadas: [ 117.216783] tegra_xusb_enter_elpg+0x23c/0x658 [ 117.222021] tegra_xusb_runtime_suspend+0x40/0x68 [ 117.227260] pm_generic_runtime_suspend+0x30/0x50 [ 117.232847] __rpm_callback+0x84/0x3c0 [ 117.237038] rpm_suspend+0x2dc/0x740 [ 117.241229] pm_runtime_work+0xa0/0xb8 [ 117.245769] proceso_trabajo_programado+0x24c/0x478 [ 117.251007] subproceso_trabajador+0x23c/0x328 [ 117.255547] kthread+0x104/0x1b0 [ 117.259389] ret_from_fork+0x10/0x20 [ 117.263582] C\u00f3digo: 54000222 f9461ae8 f8747908 b4ffff48 (f9400100)"
          }
        ],
        "id": "CVE-2024-50075",
        "lastModified": "2026-08-04T11:21:15.317",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-50075",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:23:31.784076Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-29T01:15:04.613",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7d381137cb6ecf558ef6698c7730ddd482d4c8f2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9c696bf4ab54c7cec81221887564305f0ceeac0a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c46555f14b71f95a447f5d49fc3f1f80a1472da2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T18:32:38+00:00",
      "cve": "CVE-2024-50075",
      "id": "CVE-2024-50075",
      "initial_release_date": "2024-10-29T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xhci: tegra: fix checked USB2 port number",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50075.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:28:46Z",
      "cve": "CVE-2024-50075",
      "id": "CVE-2024-50075",
      "initial_release_date": "2024-10-29T04:15:51Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "426",
      "product_status:recommended": "410",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50075",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50075.json",
      "version": "59"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-50075",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T20:23:31.784076Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "description": "CWE-noinfo Not enough information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T15:13:16.605Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/usb/host/xhci-tegra.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "9c696bf4ab54c7cec81221887564305f0ceeac0a",
                  "status": "affected",
                  "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56",
                  "versionType": "git"
                },
                {
                  "lessThan": "c46555f14b71f95a447f5d49fc3f1f80a1472da2",
                  "status": "affected",
                  "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56",
                  "versionType": "git"
                },
                {
                  "lessThan": "7d381137cb6ecf558ef6698c7730ddd482d4c8f2",
                  "status": "affected",
                  "version": "a30951d31b250bf3479c00e93646b6cc6fb42a56",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/usb/host/xhci-tegra.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.3"
                },
                {
                  "lessThan": "6.3",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.58",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.58",
                      "versionStartIncluding": "6.3",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.5",
                      "versionStartIncluding": "6.3",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12",
                      "versionStartIncluding": "6.3",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: tegra: fix checked USB2 port number\n\nIf USB virtualizatoin is enabled, USB2 ports are shared between all\nVirtual Functions. The USB2 port number owned by an USB2 root hub in\na Virtual Function may be less than total USB2 phy number supported\nby the Tegra XUSB controller.\n\nUsing total USB2 phy number as port number to check all PORTSC values\nwould cause invalid memory access.\n\n[  116.923438] Unable to handle kernel paging request at virtual address 006c622f7665642f\n...\n[  117.213640] Call trace:\n[  117.216783]  tegra_xusb_enter_elpg+0x23c/0x658\n[  117.222021]  tegra_xusb_runtime_suspend+0x40/0x68\n[  117.227260]  pm_generic_runtime_suspend+0x30/0x50\n[  117.232847]  __rpm_callback+0x84/0x3c0\n[  117.237038]  rpm_suspend+0x2dc/0x740\n[  117.241229] pm_runtime_work+0xa0/0xb8\n[  117.245769]  process_scheduled_works+0x24c/0x478\n[  117.251007]  worker_thread+0x23c/0x328\n[  117.255547]  kthread+0x104/0x1b0\n[  117.259389]  ret_from_fork+0x10/0x20\n[  117.263582] Code: 54000222 f9461ae8 f8747908 b4ffff48 (f9400100)"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T20:44:56.055Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/9c696bf4ab54c7cec81221887564305f0ceeac0a"
            },
            {
              "url": "https://git.kernel.org/stable/c/c46555f14b71f95a447f5d49fc3f1f80a1472da2"
            },
            {
              "url": "https://git.kernel.org/stable/c/7d381137cb6ecf558ef6698c7730ddd482d4c8f2"
            }
          ],
          "title": "xhci: tegra: fix checked USB2 port number",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-50075",
        "datePublished": "2024-10-29T00:50:17.304Z",
        "dateReserved": "2024-10-21T19:36:19.940Z",
        "dateUpdated": "2026-05-11T20:44:56.055Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.