CVE-2024-42128 Details
Description
In the Linux kernel, the following vulnerability has been resolved: leds: an30259a: Use devm_mutex_init() for mutex initialization In this driver LEDs are registered using devm_led_classdev_register() so they are automatically unregistered after module's remove() is done. led_classdev_unregister() calls module's led_set_brightness() to turn off the LEDs and that callback uses mutex which was destroyed already in module's remove() so use devm API instead.
A vulnerability exists in the Linux kernel's AN30259A LED driver, where mutexes are improperly initialized. The issue arises because LEDs are registered with a function that automatically handles their unregistration upon module removal. However, the unregistration process calls a function to turn off the LEDs, which relies on a mutex that has already been destroyed during module removal. This vulnerability affects the Linux kernel stable tree.
The vulnerability has been addressed by changing the mutex initialization to use the 'devm_mutex_init()' function, which properly manages the mutex's lifecycle. Users should update to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 10, 2024References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.20, < 6.6.39 >= 6.7, < 6.9.9 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 29, 2025 | Initial Analysis | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| Jul 30, 2024 | New CVE Received | kernel.org |