CVE-2024-27021: r8169: fix LED-related deadlock on module removal
In the Linux kernel, the following vulnerability has been resolved:
r8169: fix LED-related deadlock on module removal
Binding devmledclassdevregister() to the netdev is problematic because on module removal we get a RTNL-related deadlock. Fix this by avoiding the device-managed LED functions.
Note: We can safely call ledclassdevunregister() for a LED even if registering it failed, because ledclassdevunregister() detects this and is a no-op in this case.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.8.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the r8169 driver, avoid device-managed LED functions such as devm_led_classdev_register(); explicitly call led_classdev_unregister() during module removal, including when LED registration failed.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27021?
CVE-2024-27021 has a medium severity due to the resultant deadlock during module removal in the Linux kernel.
How do I fix CVE-2024-27021?
To address CVE-2024-27021, update to the corrected versions of the Linux kernel, such as 5.10.223-1, 6.1.123-1, or later.
Which versions of the Linux kernel are affected by CVE-2024-27021?
CVE-2024-27021 affects Linux kernel versions between 6.8 and 6.9-rc3.
What kind of exploitation risk does CVE-2024-27021 pose?
CVE-2024-27021 can lead to system instability due to a deadlock condition during module removal.
Is CVE-2024-27021 a remote or local vulnerability?
CVE-2024-27021 is considered a local vulnerability, as it requires module removal actions on the affected system.