CVE-2024-42128 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved:

leds: an30259a: Use devm_mutex_init() for mutex initialization

In this driver LEDs are registered using devm_led_classdev_register()
so they are automatically unregistered after module's remove() is done.
led_classdev_unregister() calls module's led_set_brightness() to turn off
the LEDs and that callback uses mutex which was destroyed already
in module's remove() so use devm API instead.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00038.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Linux	Linux Kernel

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Linux	Linux Kernel

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://git.kernel.org/stable/c/3ead19aa341de89a8c3d88a091d8093ebea622e8
https://git.kernel.org/stable/c/9dba44460bfca657ca43f03ea9bafa4f9f7dd077
https://git.kernel.org/stable/c/c382e2e3eccb6b7ca8c7aff5092c1668428e7de6
https://lore.kernel.org/linux-cve-announce/2024073026-CVE-2024-42128-9ac9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-42128
https://www.cve.org/CVERecord?id=CVE-2024-42128

History

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-07-30T07:46:24.751Z

Updated: 2025-07-28T11:16:38.410Z

Reserved: 2024-07-29T15:50:41.185Z

Link: CVE-2024-42128

Vulnrichment

Updated: 2024-08-02T04:54:31.855Z

NVD

Status : Awaiting Analysis

Published: 2024-07-30T08:15:04.903

Modified: 2024-11-21T09:33:39.697

Link: CVE-2024-42128

Redhat

Severity : Low

Publid Date: 2024-07-30T00:00:00Z

Links: CVE-2024-42128 - Bugzilla

OpenCVE Enrichment

Updated: 2025-07-12T22:09:50Z

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42128", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-29T15:50:41.185Z", "datePublished": "2024-07-30T07:46:24.751Z", "dateUpdated": "2025-07-28T11:16:38.410Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-07-28T11:16:38.410Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: an30259a: Use devm_mutex_init() for mutex initialization\n\nIn this driver LEDs are registered using devm_led_classdev_register()\nso they are automatically unregistered after module's remove() is done.\nled_classdev_unregister() calls module's led_set_brightness() to turn off\nthe LEDs and that callback uses mutex which was destroyed already\nin module's remove() so use devm API instead."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/leds/leds-an30259a.c"], "versions": [{"version": "2d00f35c55e74fcb5626c9aa336c1ed697cd2ae9", "lessThan": "3ead19aa341de89a8c3d88a091d8093ebea622e8", "status": "affected", "versionType": "git"}, {"version": "2d00f35c55e74fcb5626c9aa336c1ed697cd2ae9", "lessThan": "9dba44460bfca657ca43f03ea9bafa4f9f7dd077", "status": "affected", "versionType": "git"}, {"version": "2d00f35c55e74fcb5626c9aa336c1ed697cd2ae9", "lessThan": "c382e2e3eccb6b7ca8c7aff5092c1668428e7de6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/leds/leds-an30259a.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.39", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.9", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.9.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3ead19aa341de89a8c3d88a091d8093ebea622e8"}, {"url": "https://git.kernel.org/stable/c/9dba44460bfca657ca43f03ea9bafa4f9f7dd077"}, {"url": "https://git.kernel.org/stable/c/c382e2e3eccb6b7ca8c7aff5092c1668428e7de6"}], "title": "leds: an30259a: Use devm_mutex_init() for mutex initialization", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:54:31.855Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3ead19aa341de89a8c3d88a091d8093ebea622e8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9dba44460bfca657ca43f03ea9bafa4f9f7dd077", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c382e2e3eccb6b7ca8c7aff5092c1668428e7de6", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42128", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:16:35.114946Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:04.248Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/3ead19aa341de89a8c3d88a091d8093ebea622e8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9dba44460bfca657ca43f03ea9bafa4f9f7dd077", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c382e2e3eccb6b7ca8c7aff5092c1668428e7de6", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:54:31.855Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42128", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:16:35.114946Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:14.357Z"}}], "cna": {"title": "leds: an30259a: Use devm_mutex_init() for mutex initialization", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2d00f35c55e74fcb5626c9aa336c1ed697cd2ae9", "lessThan": "3ead19aa341de89a8c3d88a091d8093ebea622e8", "versionType": "git"}, {"status": "affected", "version": "2d00f35c55e74fcb5626c9aa336c1ed697cd2ae9", "lessThan": "9dba44460bfca657ca43f03ea9bafa4f9f7dd077", "versionType": "git"}, {"status": "affected", "version": "2d00f35c55e74fcb5626c9aa336c1ed697cd2ae9", "lessThan": "c382e2e3eccb6b7ca8c7aff5092c1668428e7de6", "versionType": "git"}], "programFiles": ["drivers/leds/leds-an30259a.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"status": "unaffected", "version": "0", "lessThan": "4.20", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.39", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.9", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/leds/leds-an30259a.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3ead19aa341de89a8c3d88a091d8093ebea622e8"}, {"url": "https://git.kernel.org/stable/c/9dba44460bfca657ca43f03ea9bafa4f9f7dd077"}, {"url": "https://git.kernel.org/stable/c/c382e2e3eccb6b7ca8c7aff5092c1668428e7de6"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: an30259a: Use devm_mutex_init() for mutex initialization\n\nIn this driver LEDs are registered using devm_led_classdev_register()\nso they are automatically unregistered after module's remove() is done.\nled_classdev_unregister() calls module's led_set_brightness() to turn off\nthe LEDs and that callback uses mutex which was destroyed already\nin module's remove() so use devm API instead."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.39", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.9", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "4.20"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-07-28T11:16:38.410Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42128", "state": "PUBLISHED", "dateUpdated": "2025-07-28T11:16:38.410Z", "dateReserved": "2024-07-29T15:50:41.185Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-30T07:46:24.751Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}