CVE-2024-35986

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-35986
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-35986.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-35986
Downstream
Related
Published
2024-05-20T09:47:53.074Z
Modified
2026-03-20T12:36:46.755803Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered
Details

In the Linux kernel, the following vulnerability has been resolved:

phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered

The powersupply frame-work is not really designed for there to be long living in kernel references to powersupply devices.

Specifically unregistering a powersupply while some other code has a reference to it triggers a WARN in powersupply_unregister():

WARN_ON(atomic_dec_return(&psy->use_cnt));

Folllowed by the powersupply still getting removed and the backing data freed anyway, leaving the tusb1210 charger-detect code with a dangling reference, resulting in a crash the next time tusb1210get_online() is called.

Fix this by only holding the reference in tusb1210getonline() freeing it at the end of the function. Note this still leaves a theoretical race window, but it avoids the issue when manually rmmod-ing the charger chip driver during development.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35986.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
48969a5623ed918713552e2b4f9d391c89b5e838
Fixed
25b3498485ac281e5851700e33b97f12c9533fd8
Fixed
73224a5d2180066c7fe05b4656647601ba08d588
Fixed
9827caa5105fb16d1fae2e75c8d0e4662014b3ca
Fixed
bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-35986.json"