CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: x86-android-tablets: Unregister devices in reverse order
Not all subsystems support a device getting removed while there are still consumers of the device with a reference to the device.
One example of this is the regulator subsystem. If a regulator gets unregistered while there are still drivers holding a reference a WARN() at drivers/regulator/core.c:5829 triggers, e.g.:
WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulatorunregister Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE21.X64.0005.R00.1504101516 FFD8X64R201504101516 04/10/2015 RIP: 0010:regulatorunregister Call Trace: <TASK> regulatorunregister devresreleasegroup i2cdeviceremove devicereleasedriverinternal busremovedevice devicedel deviceunregister x86androidtabletremove
On the Lenovo Yoga Tablet 2 series the bq24190 charger chip also provides a 5V boost converter output for powering USB devices connected to the micro USB port, the bq24190-charger driver exports this as a Vbus regulator.
On the 830 (8") and 1050 ("10") models this regulator is controlled by a platformdevice and x86androidtabletremove() removes platformdevice-s before i2cclients so the consumer gets removed first.
But on the 1380 (13") model there is a lc824206xa micro-USB switch connected over I2C and the extcon driver for that controls the regulator. The bq24190 i2c-client must be registered first, because that creates the regulator with the lc824206xa listed as its consumer. If the regulator has not been registered yet the lc824206xa driver will end up getting a dummy regulator.
Since in this case both the regulator provider and consumer are I2C devices, the only way to ensure that the consumer is unregistered first is to unregister the I2C devices in reverse order of in which they were created.
For consistency and to avoid similar problems in the future change x86androidtabletremove() to unregister all device types in reverse order.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40975?
CVE-2024-40975 is classified as a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-40975?
To fix CVE-2024-40975, update the Linux kernel to version 6.12.11-1 or 6.12.12-1 if you are using Debian.
Which versions of the Linux kernel are affected by CVE-2024-40975?
CVE-2024-40975 affects Linux kernel versions up to and including 5.10.226-1 and 6.1.123-1.
What type of vulnerability is CVE-2024-40975?
CVE-2024-40975 is a vulnerability related to the improper management of device unregistration in the Linux kernel.
Is CVE-2024-40975 applicable to Android devices?
Yes, CVE-2024-40975 specifically affects the x86 Android tablets running the Linux kernel.