CVE-2024-42128

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified) Linux kernel versions prior to 6.6.43

Description The issue in the Linux kernel is related to the use of mutex initialization in the LEDs driver. The driver registers LEDs using devm led classdev register(), which automatically unregisters them after the module's remove() is done. However, led classdev unregister() calls the module's led set brightness() to turn off the LEDs, and this callback uses a mutex that was already destroyed in the module's remove(). To resolve this, devm mutex init() is used for mutex initialization.

Recommendations For Linux kernel versions prior to 6.6.43, update to version 6.6.43 or later to resolve the issue. As a temporary workaround, consider disabling the led set brightness() function until a patch is available. Restrict access to the LEDs driver to minimize the risk of exploitation.