PT-2024-29760 · Linux+3 · Linux Kernel+3
Published
2024-04-11
·
Updated
2026-05-26
·
CVE-2024-42128
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Linux kernel versions prior to 6.6.43
Description
The issue in the Linux kernel is related to the use of mutex initialization in the LEDs driver. The driver registers LEDs using devm led classdev register(), which automatically unregisters them after the module's remove() is done. However, led classdev unregister() calls the module's led set brightness() to turn off the LEDs, and this callback uses a mutex that was already destroyed in the module's remove(). To resolve this, devm mutex init() is used for mutex initialization.
Recommendations
For Linux kernel versions prior to 6.6.43, update to version 6.6.43 or later to resolve the issue.
As a temporary workaround, consider disabling the led set brightness() function until a patch is available.
Restrict access to the LEDs driver to minimize the risk of exploitation.
Exploit
Fix
Improper Initialization
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Ubuntu