CVE-2024-35986 (GCVE-0-2024-35986)

Vulnerability from cvelistv5 – Published: 2024-05-20 09:47 – Updated: 2026-08-05 11:31
VLAI
Title
phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered
Summary
In the Linux kernel, the following vulnerability has been resolved: phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered The power_supply frame-work is not really designed for there to be long living in kernel references to power_supply devices. Specifically unregistering a power_supply while some other code has a reference to it triggers a WARN in power_supply_unregister(): WARN_ON(atomic_dec_return(&psy->use_cnt)); Folllowed by the power_supply still getting removed and the backing data freed anyway, leaving the tusb1210 charger-detect code with a dangling reference, resulting in a crash the next time tusb1210_get_online() is called. Fix this by only holding the reference in tusb1210_get_online() freeing it at the end of the function. Note this still leaves a theoretical race window, but it avoids the issue when manually rmmod-ing the charger chip driver during development.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 48969a5623ed918713552e2b4f9d391c89b5e838 , < 25b3498485ac281e5851700e33b97f12c9533fd8 (git)
Affected: 48969a5623ed918713552e2b4f9d391c89b5e838 , < 73224a5d2180066c7fe05b4656647601ba08d588 (git)
Affected: 48969a5623ed918713552e2b4f9d391c89b5e838 , < 9827caa5105fb16d1fae2e75c8d0e4662014b3ca (git)
Affected: 48969a5623ed918713552e2b4f9d391c89b5e838 , < bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052 (git)
Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.90 , ≤ 6.1.* (semver)
Unaffected: 6.6.30 , ≤ 6.6.* (semver)
Unaffected: 6.8.9 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35986",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-29T18:11:49.424190Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-29T20:00:28.396Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:11.621Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/25b3498485ac281e5851700e33b97f12c9533fd8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/73224a5d2180066c7fe05b4656647601ba08d588"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9827caa5105fb16d1fae2e75c8d0e4662014b3ca"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/ti/phy-tusb1210.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25b3498485ac281e5851700e33b97f12c9533fd8",
              "status": "affected",
              "version": "48969a5623ed918713552e2b4f9d391c89b5e838",
              "versionType": "git"
            },
            {
              "lessThan": "73224a5d2180066c7fe05b4656647601ba08d588",
              "status": "affected",
              "version": "48969a5623ed918713552e2b4f9d391c89b5e838",
              "versionType": "git"
            },
            {
              "lessThan": "9827caa5105fb16d1fae2e75c8d0e4662014b3ca",
              "status": "affected",
              "version": "48969a5623ed918713552e2b4f9d391c89b5e838",
              "versionType": "git"
            },
            {
              "lessThan": "bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052",
              "status": "affected",
              "version": "48969a5623ed918713552e2b4f9d391c89b5e838",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/ti/phy-tusb1210.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.90",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.30",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered\n\nThe power_supply frame-work is not really designed for there to be\nlong living in kernel references to power_supply devices.\n\nSpecifically unregistering a power_supply while some other code has\na reference to it triggers a WARN in power_supply_unregister():\n\n\tWARN_ON(atomic_dec_return(\u0026psy-\u003euse_cnt));\n\nFolllowed by the power_supply still getting removed and the\nbacking data freed anyway, leaving the tusb1210 charger-detect code\nwith a dangling reference, resulting in a crash the next time\ntusb1210_get_online() is called.\n\nFix this by only holding the reference in tusb1210_get_online()\nfreeing it at the end of the function. Note this still leaves\na theoretical race window, but it avoids the issue when manually\nrmmod-ing the charger chip driver during development."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The dangling `power_supply` is dereferenced through a local sysfs read of the world-readable `/sys/class/power_supply/tusb1211-charger-detect/online` attribute, or by the driver\u0027s own workqueue; there is no network or remote-peer input involved.\nAC:H - The stale reference only becomes dangerous after the bq24190 charger psy is unregistered, which requires a driver unbind (0200 sysfs) or module removal (CAP_SYS_MODULE, unreachable via user namespaces) \u2014 a system state the unprivileged attacker cannot induce and must wait for.\nPR:L - Once the charger driver has been detached, any unprivileged local user can trigger the use-after-free by reading the 0444 `online` sysfs attribute exported by the tusb1211-charger-detect power supply.\nUI:N - No victim action is needed for the trigger itself \u2014 the attacker\u0027s own sysfs read reaches the freed object, and `tusb1210_chg_det_work` hits it autonomously on the next USB charger event.\nS:U - The dangling dereference and its consequences stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free of the `bq24190_dev_info` object (and of the module-resident `power_supply_desc` after rmmod) lets an attacker who reclaims the freed slab/module memory steer reads through attacker-controlled pointers, with a value derived from freed memory returned to userspace via the `online` property.\nI:H - The freed object supplies the `desc-\u003eget_property` function pointer and the `bdi-\u003edev`/`bdi-\u003eregmap` pointers used for subsequent writes, so heap spraying over the freed allocation yields control-flow hijack and write primitives.\nA:H - The unfixed path reliably oopses \u2014 the commit describes a crash on the next `tusb1210_get_online()` call, preceded by a `WARN_ON` in `power_supply_unregister()`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:23.957Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/25b3498485ac281e5851700e33b97f12c9533fd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/73224a5d2180066c7fe05b4656647601ba08d588"
        },
        {
          "url": "https://git.kernel.org/stable/c/9827caa5105fb16d1fae2e75c8d0e4662014b3ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052"
        }
      ],
      "title": "phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35986",
    "datePublished": "2024-05-20T09:47:53.074Z",
    "dateReserved": "2024-05-17T13:50:33.145Z",
    "dateUpdated": "2026-08-05T11:31:23.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35986",
      "date": "2026-08-10",
      "epss": "0.00221",
      "percentile": "0.12616"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nphy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered\\n\\nThe power_supply frame-work is not really designed for there to be\\nlong living in kernel references to power_supply devices.\\n\\nSpecifically unregistering a power_supply while some other code has\\na reference to it triggers a WARN in power_supply_unregister():\\n\\n\\tWARN_ON(atomic_dec_return(\u0026psy-\u003euse_cnt));\\n\\nFolllowed by the power_supply still getting removed and the\\nbacking data freed anyway, leaving the tusb1210 charger-detect code\\nwith a dangling reference, resulting in a crash the next time\\ntusb1210_get_online() is called.\\n\\nFix this by only holding the reference in tusb1210_get_online()\\nfreeing it at the end of the function. Note this still leaves\\na theoretical race window, but it avoids the issue when manually\\nrmmod-ing the charger chip driver during development.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: phy: ti: tusb1210: resolver el bloqueo del cargador-det si el cargador psy no est\\u00e1 registrado. El marco power_supply no est\\u00e1 realmente manipulado para que haya referencias duraderas en el kernel a los dispositivos power_supply. Espec\\u00edficamente, cancelar el registro de un power_supply mientras alg\\u00fan otro c\\u00f3digo tiene una referencia a \\u00e9l activa una ADVERTENCIA en power_supply_unregister(): WARN_ON(atomic_dec_return(\u0026amp;psy-\u0026gt;use_cnt)); Seguido por power_supply a\\u00fan se elimina y los datos de respaldo se liberan de todos modos, dejando el c\\u00f3digo de detecci\\u00f3n del cargador tusb1210 con una referencia colgante, lo que resulta en un bloqueo la pr\\u00f3xima vez que se llama a tusb1210_get_online(). Solucione este problema manteniendo \\u00fanicamente la referencia en tusb1210_get_online() liber\\u00e1ndola al final de la funci\\u00f3n. Tenga en cuenta que esto a\\u00fan deja una ventana de ejecuci\\u00f3n te\\u00f3rica, pero evita el problema al modificar manualmente el controlador del chip del cargador durante el desarrollo.\"}]",
      "id": "CVE-2024-35986",
      "lastModified": "2024-11-21T09:21:21.980",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-20T10:15:12.990",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/25b3498485ac281e5851700e33b97f12c9533fd8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/73224a5d2180066c7fe05b4656647601ba08d588\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9827caa5105fb16d1fae2e75c8d0e4662014b3ca\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/25b3498485ac281e5851700e33b97f12c9533fd8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/73224a5d2180066c7fe05b4656647601ba08d588\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9827caa5105fb16d1fae2e75c8d0e4662014b3ca\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35986\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:12.990\",\"lastModified\":\"2026-08-04T11:18:18.767\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nphy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered\\n\\nThe power_supply frame-work is not really designed for there to be\\nlong living in kernel references to power_supply devices.\\n\\nSpecifically unregistering a power_supply while some other code has\\na reference to it triggers a WARN in power_supply_unregister():\\n\\n\\tWARN_ON(atomic_dec_return(\u0026psy-\u003euse_cnt));\\n\\nFolllowed by the power_supply still getting removed and the\\nbacking data freed anyway, leaving the tusb1210 charger-detect code\\nwith a dangling reference, resulting in a crash the next time\\ntusb1210_get_online() is called.\\n\\nFix this by only holding the reference in tusb1210_get_online()\\nfreeing it at the end of the function. Note this still leaves\\na theoretical race window, but it avoids the issue when manually\\nrmmod-ing the charger chip driver during development.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: phy: ti: tusb1210: resolver el bloqueo del cargador-det si el cargador psy no est\u00e1 registrado. El marco power_supply no est\u00e1 realmente manipulado para que haya referencias duraderas en el kernel a los dispositivos power_supply. Espec\u00edficamente, cancelar el registro de un power_supply mientras alg\u00fan otro c\u00f3digo tiene una referencia a \u00e9l activa una ADVERTENCIA en power_supply_unregister(): WARN_ON(atomic_dec_return(\u0026amp;psy-\u0026gt;use_cnt)); Seguido por power_supply a\u00fan se elimina y los datos de respaldo se liberan de todos modos, dejando el c\u00f3digo de detecci\u00f3n del cargador tusb1210 con una referencia colgante, lo que resulta en un bloqueo la pr\u00f3xima vez que se llama a tusb1210_get_online(). Solucione este problema manteniendo \u00fanicamente la referencia en tusb1210_get_online() liber\u00e1ndola al final de la funci\u00f3n. Tenga en cuenta que esto a\u00fan deja una ventana de ejecuci\u00f3n te\u00f3rica, pero evita el problema al modificar manualmente el controlador del chip del cargador durante el desarrollo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/phy/ti/phy-tusb1210.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"48969a5623ed918713552e2b4f9d391c89b5e838\",\"lessThan\":\"25b3498485ac281e5851700e33b97f12c9533fd8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48969a5623ed918713552e2b4f9d391c89b5e838\",\"lessThan\":\"73224a5d2180066c7fe05b4656647601ba08d588\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48969a5623ed918713552e2b4f9d391c89b5e838\",\"lessThan\":\"9827caa5105fb16d1fae2e75c8d0e4662014b3ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48969a5623ed918713552e2b4f9d391c89b5e838\",\"lessThan\":\"bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/phy/ti/phy-tusb1210.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.90\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.30\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.9\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-29T18:11:49.424190Z\",\"id\":\"CVE-2024-35986\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"6.1.90\",\"matchCriteriaId\":\"E7EA63C6-6BB3-46BD-BB05-AD28AC270B01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.30\",\"matchCriteriaId\":\"84046DAF-73CF-429D-9BA4-05B658B377B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.9\",\"matchCriteriaId\":\"5F9041E5-8358-4EF7-8F98-B812EDE49612\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"F850DCEC-E08B-4317-A33B-D2DCF39F601B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/25b3498485ac281e5851700e33b97f12c9533fd8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/73224a5d2180066c7fe05b4656647601ba08d588\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9827caa5105fb16d1fae2e75c8d0e4662014b3ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/25b3498485ac281e5851700e33b97f12c9533fd8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/73224a5d2180066c7fe05b4656647601ba08d588\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9827caa5105fb16d1fae2e75c8d0e4662014b3ca\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:53:22+00:00",
      "cve": "CVE-2024-35986",
      "id": "CVE-2024-35986",
      "initial_release_date": "2024-05-20T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35986.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T19:39:08Z",
      "cve": "CVE-2024-35986",
      "id": "CVE-2024-35986",
      "initial_release_date": "2024-05-21T01:58:29Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "264",
      "product_status:recommended": "335",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35986",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35986.json",
      "version": "78"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/25b3498485ac281e5851700e33b97f12c9533fd8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/73224a5d2180066c7fe05b4656647601ba08d588\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9827caa5105fb16d1fae2e75c8d0e4662014b3ca\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:30:11.621Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35986\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-29T18:11:49.424190Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-29T18:12:08.965Z\"}}], \"cna\": {\"title\": \"phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The dangling `power_supply` is dereferenced through a local sysfs read of the world-readable `/sys/class/power_supply/tusb1211-charger-detect/online` attribute, or by the driver\u0027s own workqueue; there is no network or remote-peer input involved.\\nAC:H - The stale reference only becomes dangerous after the bq24190 charger psy is unregistered, which requires a driver unbind (0200 sysfs) or module removal (CAP_SYS_MODULE, unreachable via user namespaces) \\u2014 a system state the unprivileged attacker cannot induce and must wait for.\\nPR:L - Once the charger driver has been detached, any unprivileged local user can trigger the use-after-free by reading the 0444 `online` sysfs attribute exported by the tusb1211-charger-detect power supply.\\nUI:N - No victim action is needed for the trigger itself \\u2014 the attacker\u0027s own sysfs read reaches the freed object, and `tusb1210_chg_det_work` hits it autonomously on the next USB charger event.\\nS:U - The dangling dereference and its consequences stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - Use-after-free of the `bq24190_dev_info` object (and of the module-resident `power_supply_desc` after rmmod) lets an attacker who reclaims the freed slab/module memory steer reads through attacker-controlled pointers, with a value derived from freed memory returned to userspace via the `online` property.\\nI:H - The freed object supplies the `desc-\u003eget_property` function pointer and the `bdi-\u003edev`/`bdi-\u003eregmap` pointers used for subsequent writes, so heap spraying over the freed allocation yields control-flow hijack and write primitives.\\nA:H - The unfixed path reliably oopses \\u2014 the commit describes a crash on the next `tusb1210_get_online()` call, preceded by a `WARN_ON` in `power_supply_unregister()`.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"48969a5623ed918713552e2b4f9d391c89b5e838\", \"lessThan\": \"25b3498485ac281e5851700e33b97f12c9533fd8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"48969a5623ed918713552e2b4f9d391c89b5e838\", \"lessThan\": \"73224a5d2180066c7fe05b4656647601ba08d588\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"48969a5623ed918713552e2b4f9d391c89b5e838\", \"lessThan\": \"9827caa5105fb16d1fae2e75c8d0e4662014b3ca\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"48969a5623ed918713552e2b4f9d391c89b5e838\", \"lessThan\": \"bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/phy/ti/phy-tusb1210.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.90\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.30\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/phy/ti/phy-tusb1210.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/25b3498485ac281e5851700e33b97f12c9533fd8\"}, {\"url\": \"https://git.kernel.org/stable/c/73224a5d2180066c7fe05b4656647601ba08d588\"}, {\"url\": \"https://git.kernel.org/stable/c/9827caa5105fb16d1fae2e75c8d0e4662014b3ca\"}, {\"url\": \"https://git.kernel.org/stable/c/bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nphy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered\\n\\nThe power_supply frame-work is not really designed for there to be\\nlong living in kernel references to power_supply devices.\\n\\nSpecifically unregistering a power_supply while some other code has\\na reference to it triggers a WARN in power_supply_unregister():\\n\\n\\tWARN_ON(atomic_dec_return(\u0026psy-\u003euse_cnt));\\n\\nFolllowed by the power_supply still getting removed and the\\nbacking data freed anyway, leaving the tusb1210 charger-detect code\\nwith a dangling reference, resulting in a crash the next time\\ntusb1210_get_online() is called.\\n\\nFix this by only holding the reference in tusb1210_get_online()\\nfreeing it at the end of the function. Note this still leaves\\na theoretical race window, but it avoids the issue when manually\\nrmmod-ing the charger chip driver during development.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.90\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.30\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.9\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:23.957Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35986\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:23.957Z\", \"dateReserved\": \"2024-05-17T13:50:33.145Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-20T09:47:53.074Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.