Denial of Service Vulnerability in Linux Kernel Affecting USB Devices

CVE-2016-3689

Summary

A vulnerability in the Linux kernel allows attackers with physical access to exploit USB devices, leading to a denial of service through system crashes. This issue arises from the ims_pcu_parse_cdc_data function in the driver, which mismanages device interfaces. When a malicious USB device is connected, the absence of both a master and a slave interface can trigger a crash, causing potential disruption in service and rendering the system unresponsive. System administrators should ensure they are running Linux kernel version 4.5.1 or later to mitigate this risk.

References