Linux Kernel
CVE-2024-35986
HIGH
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Unloading a kernel module requires root/CAP_SYS_MODULE (PR:H), and triggering the race between PSY unregistration and tusb1210_get_online() is non-trivial (AC:H).
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered
The power_supply frame-work is not really designed for there to be long living in kernel references to power_supply devices.
Specifically unregistering a power_supply while some other code has a reference to it triggers a WARN in power_supply_unregister():
WARN_ON(atomic_dec_return(&psy->use_cnt));
Folllowed by the power_supply still getting removed and the backing data freed anyway, leaving the tusb1210 charger-detect code with a dangling reference, resulting in a crash the next time tusb1210_get_online() is called.
Fix this by only holding the reference in tusb1210_get_online() freeing it at the end of the function. Note this still leaves a theoretical race window, but it avoids the issue when manually rmmod-ing the charger chip driver during development.
AnalysisAI
Use-after-free in the Linux kernel's TUSB1210 USB PHY charger-detection driver allows a local attacker to crash the kernel or potentially escalate privileges when the charger power supply device is unregistered while the tusb1210 driver holds a live reference. The power_supply framework does not protect against long-lived references across unregistration events, leaving tusb1210_get_online() with a dangling pointer that dereferences freed memory on next invocation. No public exploit code exists and EPSS is 0.21%, indicating low exploitation activity; the defect has been patched across multiple stable kernel branches.
Technical ContextAI
The affected component is the TI TUSB1210 USB PHY driver (drivers/phy/ti/tusb1210.c) within the Linux kernel, confirmed by CPE cpe:2.3:o:linux:linux_kernel across multiple version ranges through 6.9-rc5. The root cause is CWE-416 (Use After Free): the driver retained a reference to a power_supply object beyond the object's lifetime. The Linux power_supply framework emits WARN_ON(atomic_dec_return(&psy->use_cnt)) when unregister is called while a reference count is nonzero, but still proceeds to free the backing structure. The tusb1210 charger-detection code stored this reference persistently, so any subsequent call to tusb1210_get_online() would dereference the freed memory, causing a kernel panic or undefined behavior. The fix scopes the power_supply reference acquisition and release entirely within tusb1210_get_online(), reducing - but not eliminating - the race window.
RemediationAI
The primary remediation is to apply the upstream kernel patches available at https://git.kernel.org/stable/c/25b3498485ac281e5851700e33b97f12c9533fd8, https://git.kernel.org/stable/c/73224a5d2180066c7fe05b4656647601ba08d588, https://git.kernel.org/stable/c/9827caa5105fb16d1fae2e75c8d0e4662014b3ca, and https://git.kernel.org/stable/c/bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052. No exact downstream release version is confirmed in the available data - distributions should be consulted for their specific versioned packages incorporating these commits. As a compensating control where patching is not immediately possible, restricting CAP_SYS_MODULE privileges (e.g., via seccomp, AppArmor, or SELinux policy preventing module unloading) would prevent the triggering sequence, though this may impact legitimate system operations that rely on dynamic module loading.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today