PT-2024-27225 · Linux+4 · Linux Kernel+4
Published
2024-04-26
·
Updated
2025-09-29
·
CVE-2024-36961
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.8
Description
The issue arises from two locking problems in the thermal zone debug code within the Linux kernel. The first problem occurs when user space opens the "mitigations" file for a thermal zone before the zone's debugfs pointer is set, resulting in a NULL pointer dereference in
tze seq start(). The second problem is that thermal debug tz remove() is not called under the thermal zone lock, allowing it to run in parallel with other functions accessing the thermal zone's struct thermal debugfs object. This can lead to the premature freeing of the struct thermal debugfs object.Recommendations
To address the first problem, pass a pointer to the thermal zone's
struct thermal debugfs object to debugfs create file() in thermal debug tz add() and make tze seq start(), tze seq next(), tze seq stop(), and tze seq show() retrieve it from s->private instead of a pointer to the thermal zone object.
To address the second problem, use tz->lock in thermal debug tz remove() around the tz->debugfs value check and its reset to NULL.
Update to Linux kernel version 6.8 or later to resolve the issue.Exploit
Fix
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Ubuntu