CVE-2024-57889

5.5 · MEDIUM

Published Jan 15, 2025 linux CWE-667 EPSS 0.17% (6th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-57889 is a medium-severity vulnerability affecting linux linux_kernel. It was published on January 15, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking

If a device uses MCP23xxx IO expander to receive IRQs, the following

bug can happen:

BUG: sleeping function called from invalid context

at kernel/locking/mutex.c:283

in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ...

preempt_count: 1, expected: 0

...

Call Trace:

...

__might_resched+0x104/0x10e

__might_sleep+0x3e/0x62

mutex_lock+0x20/0x4c

regmap_lock_mutex+0x10/0x18

regmap_update_bits_base+0x2c/0x66

mcp23s08_irq_set_type+0x1ae/0x1d6

__irq_set_trigger+0x56/0x172

__setup_irq+0x1e6/0x646

request_threaded_irq+0xb6/0x160

...

We observed the problem while experimenting with a touchscreen driver which

used MCP23017 IO expander (I2C).

The regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from

concurrent accesses, which is the default for regmaps without .fast_io,

.disable_locking, etc.

mcp23s08_ir

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 4.13, < 5.4.289	Affected

References

Ref git.kernel.org/stable/c/0310cbad163a908d09d99c26827859365cd71fcb Ref git.kernel.org/stable/c/788d9e9a41b81893d6bb8faa05f045c975278318 Ref git.kernel.org/stable/c/830f838589522404cd7c2f0f540602f25034af61 Ref git.kernel.org/stable/c/8c6fd5803b988a5e78c9b9e42c70a936d7cfc6ec Ref git.kernel.org/stable/c/9372e160d8211a7e17f2abff8370794f182df785 Ref git.kernel.org/stable/c/a37eecb705f33726f1fb7cd2a67e514a15dfe693 Ref git.kernel.org/stable/c/c55d186376a87b468c9ee30f2195e0f3857f61a0 Ref lists.debian.org/debian-lts-announce/2025/03/msg00001.html Ref lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Frequently Asked Questions

What is CVE-2024-57889?

CVE-2024-57889 is a medium-severity vulnerability affecting linux linux_kernel. It was published on January 15, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-57889?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-57889?

How can CyberStrike help with CVE-2024-57889?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-57889 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719