Critical Device Unregistration Vulnerability in Linux Kernel - CVE-2024-40975
Summary
CVE-2024-40975: In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: Unregister devices in reverse order Not all subsystems support a device getting removed while there are still consume... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It supports a wide range of devices and architectures, making it a critical element for both servers and personal computing. This vulnerability specifically affects the x86 Android tablets, where improper device unregistration can lead to system instability and potential security risks.
Vulnerability Detail
CVE-2024-40975 arises from the improper order of device unregistration in the Linux kernel's platform/x86 subsystem. When a device is removed while still being referenced by consumers, it can trigger warnings and lead to undefined behavior. This is particularly problematic in the regulator subsystem, where unregistered regulators can cause drivers to receive dummy regulators, leading to malfunctioning hardware components. The vulnerability is rooted in the x86_android_tablet_remove() function, which does not unregister devices in the correct order, potentially affecting devices like the Lenovo Yoga Tablet 2 series.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually ensure that I2C devices are unregistered in reverse order before removing any associated regulators. This can be done by modifying the device removal sequence in the driver code, ensuring that consumers are unregistered before their providers.
Conclusion
CVE-2024-40975 is a significant vulnerability in the Linux kernel that can lead to serious system issues if not addressed. Users are encouraged to update their systems to the latest kernel version to mitigate the risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2024-40975 is a vulnerability in the Linux kernel that affects the unregistration order of devices, potentially leading to system instability.
The vulnerability affects Linux kernel versions prior to 6.9.7-1 across Debian 11, 12, and 13.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected. Visit Vulert Scanner to use the Vulert playground.
The risks include potential system crashes, hardware malfunctions, and undefined behavior due to improper device management.
Yes, updating to Linux kernel version 6.9.7-1 or later provides a permanent fix for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
