Linux Kernel Vulnerability CVE-2024-42319: Improper PM Runtime Management in mtk-cmdq
Summary
CVE-2024-42319: In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable() When mtk-cmdq unbinds, a WARN_ON message with condition pm_runtim... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The mtk-cmdq driver is responsible for managing command queues in MediaTek devices, facilitating efficient communication between hardware components. This vulnerability arises from improper management of power management runtime functions, potentially leading to system instability during device unbinding.
Vulnerability Detail
The vulnerability identified as CVE-2024-42319 occurs in the Linux kernel's mtk-cmdq driver. It is caused by a sequence error where the function devm_mbox_controller_register() is called before devm_pm_runtime_enable(). This misordering leads to a situation where pm_runtime_get_sync() is invoked after pm_runtime_disable(), resulting in a WARN_ON message. The improper handling of power management can cause system crashes or unexpected behavior when the cmdq device is unbound, posing a risk to system stability and reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the fix as outlined above.
Conclusion
CVE-2024-42319 is a significant vulnerability in the Linux kernel's mtk-cmdq driver, stemming from improper power management function sequencing. It is crucial for users and administrators to apply the recommended fix to ensure system stability and prevent potential crashes. Regular monitoring and updates are essential for maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
CVE-2024-42319 is a vulnerability in the Linux kernel's mtk-cmdq driver, related to improper power management runtime handling.
The vulnerability can lead to system instability, crashes, or unexpected behavior when the cmdq device is unbound.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without any signup.
Yes, a patch is available in the Linux kernel versions that address this issue. Ensure your system is updated to the latest version.
While there are no specific workarounds, it is advisable to monitor your system closely for any signs of instability until the fix can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
