CVE-2024-40975
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: Unregister devices in reverse order Not all subsystems support a device getting removed while there are still consumers of the device with a reference to the device. One example of this is the regulator subsystem. If a regulator gets unregistered while there are still drivers holding a reference a WARN() at drivers/regulator/core.c:5829 triggers, e.g.: WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulator_unregister Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 04/10/2015 RIP: 0010:regulator_unregister Call Trace: <TASK> regulator_unregister devres_release_group i2c_device_remove device_release_driver_internal bus_remove_device device_del device_unregister x86_android_tablet_remove On the Lenovo Yoga Tablet 2 series the bq24190 charger chip also provides a 5V boost converter output for powering USB devices connected to the micro USB port, the bq24190-charger driver exports this as a Vbus regulator. On the 830 (8") and 1050 ("10") models this regulator is controlled by a platform_device and x86_android_tablet_remove() removes platform_device-s before i2c_clients so the consumer gets removed first. But on the 1380 (13") model there is a lc824206xa micro-USB switch connected over I2C and the extcon driver for that controls the regulator. The bq24190 i2c-client *must* be registered first, because that creates the regulator with the lc824206xa listed as its consumer. If the regulator has not been registered yet the lc824206xa driver will end up getting a dummy regulator. Since in this case both the regulator provider and consumer are I2C devices, the only way to ensure that the consumer is unregistered first is to unregister the I2C devices in reverse order of in which they were created. For consistency and to avoid similar problems in the future change x86_android_tablet_remove() to unregister all device types in reverse order.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2024-07-12 13:15:19.007000
Last modified
2026-10-30 13:17:29.910000
View original CVE JSON
{
"id": "CVE-2024-40975",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-07-12T13:15:19.007",
"lastModified": "2026-10-30T13:17:29.910",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: x86-android-tablets: Unregister devices in reverse order\n\nNot all subsystems support a device getting removed while there are\nstill consumers of the device with a reference to the device.\n\nOne example of this is the regulator subsystem. If a regulator gets\nunregistered while there are still drivers holding a reference\na WARN() at drivers/regulator/core.c:5829 triggers, e.g.:\n\n WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulator_unregister\n Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 04/10/2015\n RIP: 0010:regulator_unregister\n Call Trace:\n <TASK>\n regulator_unregister\n devres_release_group\n i2c_device_remove\n device_release_driver_internal\n bus_remove_device\n device_del\n device_unregister\n x86_android_tablet_remove\n\nOn the Lenovo Yoga Tablet 2 series the bq24190 charger chip also provides\na 5V boost converter output for powering USB devices connected to the micro\nUSB port, the bq24190-charger driver exports this as a Vbus regulator.\n\nOn the 830 (8\") and 1050 (\"10\") models this regulator is controlled by\na platform_device and x86_android_tablet_remove() removes platform_device-s\nbefore i2c_clients so the consumer gets removed first.\n\nBut on the 1380 (13\") model there is a lc824206xa micro-USB switch\nconnected over I2C and the extcon driver for that controls the regulator.\nThe bq24190 i2c-client *must* be registered first, because that creates\nthe regulator with the lc824206xa listed as its consumer. If the regulator\nhas not been registered yet the lc824206xa driver will end up getting\na dummy regulator.\n\nSince in this case both the regulator provider and consumer are I2C\ndevices, the only way to ensure that the consumer is unregistered first\nis to unregister the I2C devices in reverse order of in which they were\ncreated.\n\nFor consistency and to avoid similar problems in the future change\nx86_android_tablet_remove() to unregister all device types in reverse\norder."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvió la siguiente vulnerabilidad: plataforma/x86: x86-android-tablets: cancelar el registro de dispositivos en orden inverso. No todos los subsistemas admiten la eliminación de un dispositivo mientras todavía hay consumidores del dispositivo con una referencia al dispositivo. Un ejemplo de esto es el subsistema regulador. Si un regulador se da de baja mientras todavía hay controladores que tienen una referencia, se activa WARN() en drivers/regulator/core.c:5829, por ejemplo: ADVERTENCIA: CPU: 1 PID: 1587 en drivers/regulator/core.c:5829 regulator_unregister Nombre del hardware: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 10/04/2015 RIP: 0010:regulator_unregister Seguimiento de llamada: regulator_unregister i2c_device_remove devres_release_group device_release_driver_internal device_del device_unregister x86_android_tablet_remove En la serie Lenovo Yoga Tablet 2, el chip del cargador bq24190 también proporciona una salida de convertidor elevador de 5 V para alimentar dispositivos USB conectados al puerto micro USB; el controlador del cargador bq24190 lo exporta como un regulador Vbus. En los modelos 830 (8\") y 1050 (\"10\"), este regulador está controlado por un platform_device y x86_android_tablet_remove() elimina platform_device-s antes que i2c_clients para que el consumidor se elimine primero. Pero en el modelo 1380 (13\") hay un interruptor micro-USB lc824206xa conectado a través de I2C y el controlador externo que controla el regulador. El cliente i2c bq24190 *debe* registrarse primero, porque eso crea el regulador con el lc824206xa listado como su consumidor. Si el regulador aún no se ha registrado, el controlador lc824206xa terminará obteniendo un regulador ficticio. Dado que en este caso tanto el proveedor del regulador como el consumidor son dispositivos I2C, la única forma de garantizar que el consumidor cancele el registro primero es cancelar el registro de los dispositivos I2C en el orden inverso al que fueron creados. Para mantener la coherencia y evitar problemas similares en el futuro, cambie x86_android_tablet_remove() para cancelar el registro de todos los tipos de dispositivos en orden inverso."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/platform/x86/x86-android-tablets/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "55fa3c9665bfcf32b21af8ecdeb48d5c5177d8d7",
"lessThan": "f3f8517f9839f8731e2eeccdc52fc1e84ee4a98a",
"versionType": "git",
"status": "affected"
},
{
"version": "55fa3c9665bfcf32b21af8ecdeb48d5c5177d8d7",
"lessThan": "36ff963c133a25ed1166a25c3ba8b357ea010fda",
"versionType": "git",
"status": "affected"
},
{
"version": "55fa3c9665bfcf32b21af8ecdeb48d5c5177d8d7",
"lessThan": "f0c982853d665597d17e4995ff479fbbf79a9cf6",
"versionType": "git",
"status": "affected"
},
{
"version": "55fa3c9665bfcf32b21af8ecdeb48d5c5177d8d7",
"lessThan": "3de0f2627ef849735f155c1818247f58404dddfe",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/platform/x86/x86-android-tablets/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.17",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.17",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.64",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.9.7",
"lessThanOrEqual": "6.9.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.10",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-09-10T17:02:40.847310Z",
"id": "CVE-2024-40975",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17",
"versionEndExcluding": "6.6.64",
"matchCriteriaId": "B2BD0622-6C80-4736-83B4-451E62DA8EB0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.9.7",
"matchCriteriaId": "0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/36ff963c133a25ed1166a25c3ba8b357ea010fda",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f0c982853d665597d17e4995ff479fbbf79a9cf6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f3f8517f9839f8731e2eeccdc52fc1e84ee4a98a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f0c982853d665597d17e4995ff479fbbf79a9cf6",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
]
}
]
}