CVE-2024-35986

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered

The power_supply frame-work is not really designed for there to be

long living in kernel references to power_supply devices.

Specifically unregistering a power_supply while some other code has

a reference to it triggers a WARN in power_supply_unregister():

WARN_ON(atomic_dec_return(&psy->use_cnt));

Folllowed by the power_supply still getting removed and the

backing data freed anyway, leaving the tusb1210 charger-detect code

with a dangling reference, resulting in a crash the next time

tusb1210_get_online() is called.

Fix this by only holding the reference in tusb1210_get_online()

freeing it at the end of the function. Note this still leaves

a theoretical race window, but it avoids the issue when manually

rmmod-ing the charger chip driver during development.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References