CVE-2024-42090

MediumCVSS 5.5/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER

In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock.

This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock.

This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-667

Affected software

VendorProductVersions
LinuxLinux>= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7, < e65a0dc2e85efb28e182aca50218e8a056d0ce04; >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7, < 420ce1261907e5dbeda1e4daffd5b6c76f8188c0; >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7, < b813e3fd102a959c5b208ed68afe27e0137a561b; >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7, < 01fe2f885f7813f8aed5d3704b384a97b1116a9e; >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7, < b36efd2e3e22a329444b6b24fa48df6d20ae66e6; >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7, < 4038c57bf61631219b31f1bd6e92106ec7f084dc; >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7, < 48a7a7c9571c3e62f17012dd7f2063e926179ddd; >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7, < adec57ff8e66aee632f3dd1f93787c13d112b7a1
LinuxLinux3.10
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1.1

References

Timeline

Published
Jul 29, 2024
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-420915.5In the Linux kernel, the following vulnerability has been resolved: drm/xe: Check pat.ops before dumping PAT settings We may leave pat.opsCVE-2024-420927.8In the Linux kernel, the following vulnerability has been resolved: gpio: davinci: Validate the obtained number of IRQs Value of pdata->gpCVE-2024-420937.3In the Linux kernel, the following vulnerability has been resolved: net/dpaa2: Avoid explicit cpumask var allocation on stack For CONFIG_CCVE-2024-420947.1In the Linux kernel, the following vulnerability has been resolved: net/iucv: Avoid explicit cpumask var allocation on stack For CONFIG_CPCVE-2024-420955.5In the Linux kernel, the following vulnerability has been resolved: serial: 8250_omap: Implementation of Errata i2310 As per Errata i2310[CVE-2024-420965.5In the Linux kernel, the following vulnerability has been resolved: x86: stop playing stack games in profile_pc() The 'profile_pc()' functCVE-2024-420975.5In the Linux kernel, the following vulnerability has been resolved: ALSA: emux: improve patch ioctl data validation In load_data(), make tCVE-2024-420985.5In the Linux kernel, the following vulnerability has been resolved: crypto: ecdh - explicitly zeroize private_key private_key is overwrittCVE-2024-420995.5In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix invalid dereferencing of indirect CCW data pointer Fix CVE-2024-42106.5A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior CVE-2024-421005.5In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without commonCVE-2024-421015.5In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix null pointer dereference in nouveau_connector_get_mode
CVE-2024-42090: Medium severity, CVSS 5.5 | Vulnix