CVE-2024-40975

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: x86-android-tablets: Unregister devices in reverse order

Not all subsystems support a device getting removed while there are

still consumers of the device with a reference to the device.

One example of this is the regulator subsystem. If a regulator gets

unregistered while there are still drivers holding a reference

a WARN() at drivers/regulator/core.c:5829 triggers, e.g.:

WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulator_unregister

Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 04/10/2015

RIP: 0010:regulator_unregister

Call Trace:

<TASK>

regulator_unregister

devres_release_group

i2c_device_remove

device_release_driver_internal

bus_remove_device

device_del

device_unregister

x86_android_tablet_remove

On the Lenovo Yoga Tablet 2 series the bq24190 charger chip also provides

a 5V boos

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References