GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47141 (GCVE-0-2024-47141)

Vulnerability from cvelistv5 – Published: 2025-01-11 12:25 – Updated: 2026-05-11 20:38
VLAI
Title
pinmux: Use sequential access to access desc->pinmux data
Summary
In the Linux kernel, the following vulnerability has been resolved: pinmux: Use sequential access to access desc->pinmux data When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner. Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer. Serialize the access to mux related setting with a mutex lock. cpu0 (process A) cpu1(process B) pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) { if (desc->mux_usecount > 1) return 0; desc->mux_owner = owner; } }
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:55 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 , < 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b (git)
Affected: 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 , < c11e2ec9a780f54982a187ee10ffd1b810715c85 (git)
Affected: 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 , < 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 6.6.66 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-47141",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:55:54.896424Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-667",
                "description": "CWE-667 Improper Locking",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:22.687Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pinctrl/core.c",
            "drivers/pinctrl/core.h",
            "drivers/pinctrl/pinmux.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b",
              "status": "affected",
              "version": "42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7",
              "versionType": "git"
            },
            {
              "lessThan": "c11e2ec9a780f54982a187ee10ffd1b810715c85",
              "status": "affected",
              "version": "42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7",
              "versionType": "git"
            },
            {
              "lessThan": "5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e",
              "status": "affected",
              "version": "42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pinctrl/core.c",
            "drivers/pinctrl/core.h",
            "drivers/pinctrl/pinmux.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinmux: Use sequential access to access desc-\u003epinmux data\n\nWhen two client of the same gpio call pinctrl_select_state() for the\nsame functionality, we are seeing NULL pointer issue while accessing\ndesc-\u003emux_owner.\n\nLet\u0027s say two processes A, B executing in pin_request() for the same pin\nand process A updates the desc-\u003emux_usecount but not yet updated the\ndesc-\u003emux_owner while process B see the desc-\u003emux_usecount which got\nupdated by A path and further executes strcmp and while accessing\ndesc-\u003emux_owner it crashes with NULL pointer.\n\nSerialize the access to mux related setting with a mutex lock.\n\n\tcpu0 (process A)\t\t\tcpu1(process B)\n\npinctrl_select_state() {\t\t  pinctrl_select_state() {\n  pin_request() {\t\t\t\tpin_request() {\n  ...\n\t\t\t\t\t\t ....\n    } else {\n         desc-\u003emux_usecount++;\n    \t\t\t\t\t\tdesc-\u003emux_usecount \u0026\u0026 strcmp(desc-\u003emux_owner, owner)) {\n\n         if (desc-\u003emux_usecount \u003e 1)\n               return 0;\n         desc-\u003emux_owner = owner;\n\n  }\t\t\t\t\t\t}"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:38:12.716Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c11e2ec9a780f54982a187ee10ffd1b810715c85"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e"
        }
      ],
      "title": "pinmux: Use sequential access to access desc-\u003epinmux data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47141",
    "datePublished": "2025-01-11T12:25:12.399Z",
    "dateReserved": "2025-01-09T09:50:31.758Z",
    "dateUpdated": "2026-05-11T20:38:12.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47141",
      "date": "2026-09-17",
      "epss": "0.00173",
      "percentile": "0.06982"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-07T04:14:25.000Z",
      "cve": "CVE-2024-47141",
      "id": "msrc_CVE-2024-47141",
      "initial_release_date": "2025-03-13T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:under_investigation": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "pinmux: Use sequential access to access desc-\u003epinmux data",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-47141.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47141\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T13:15:21.830\",\"lastModified\":\"2026-06-17T07:56:37.030\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npinmux: Use sequential access to access desc-\u003epinmux data\\n\\nWhen two client of the same gpio call pinctrl_select_state() for the\\nsame functionality, we are seeing NULL pointer issue while accessing\\ndesc-\u003emux_owner.\\n\\nLet\u0027s say two processes A, B executing in pin_request() for the same pin\\nand process A updates the desc-\u003emux_usecount but not yet updated the\\ndesc-\u003emux_owner while process B see the desc-\u003emux_usecount which got\\nupdated by A path and further executes strcmp and while accessing\\ndesc-\u003emux_owner it crashes with NULL pointer.\\n\\nSerialize the access to mux related setting with a mutex lock.\\n\\n\\tcpu0 (process A)\\t\\t\\tcpu1(process B)\\n\\npinctrl_select_state() {\\t\\t  pinctrl_select_state() {\\n  pin_request() {\\t\\t\\t\\tpin_request() {\\n  ...\\n\\t\\t\\t\\t\\t\\t ....\\n    } else {\\n         desc-\u003emux_usecount++;\\n    \\t\\t\\t\\t\\t\\tdesc-\u003emux_usecount \u0026\u0026 strcmp(desc-\u003emux_owner, owner)) {\\n\\n         if (desc-\u003emux_usecount \u003e 1)\\n               return 0;\\n         desc-\u003emux_owner = owner;\\n\\n  }\\t\\t\\t\\t\\t\\t}\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: pinmux: usar acceso secuencial para acceder a los datos de desc-\u0026gt;pinmux Cuando dos clientes del mismo gpio llaman a pinctrl_select_state() para la misma funcionalidad, vemos un problema de puntero NULL al acceder a desc-\u0026gt;mux_owner. Digamos que dos procesos A, B se ejecutan en pin_request() para el mismo pin y el proceso A actualiza desc-\u0026gt;mux_usecount pero a\u00fan no actualiza desc-\u0026gt;mux_owner mientras que el proceso B ve desc-\u0026gt;mux_usecount que fue actualizado por la ruta A y luego ejecuta strcmp y mientras accede a desc-\u0026gt;mux_owner se bloquea con el puntero NULL. Serialice el acceso a la configuraci\u00f3n relacionada con mux con un bloqueo de mutex. cpu0 (proceso A) cpu1 (proceso B) pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } de lo contrario { desc-\u0026gt;mux_usecount++; desc-\u0026gt;mux_usecount \u0026amp;\u0026amp; strcmp(desc-\u0026gt;mux_owner, propietario)) { si (desc-\u0026gt;mux_usecount \u0026gt; 1) devuelve 0; desc-\u0026gt;mux_owner = propietario; } }\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/pinctrl/core.c\",\"drivers/pinctrl/core.h\",\"drivers/pinctrl/pinmux.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7\",\"lessThan\":\"2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7\",\"lessThan\":\"c11e2ec9a780f54982a187ee10ffd1b810715c85\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7\",\"lessThan\":\"5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/pinctrl/core.c\",\"drivers/pinctrl/core.h\",\"drivers/pinctrl/pinmux.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.66\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:55:54.896424Z\",\"id\":\"CVE-2024-47141\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.6.66\",\"matchCriteriaId\":\"90A079EF-8212-45DF-84FB-C525A64635B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c11e2ec9a780f54982a187ee10ffd1b810715c85\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T08:06:51+00:00",
      "cve": "CVE-2024-47141",
      "id": "CVE-2024-47141",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "36",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: pinmux: Use sequential access to access desc-\u003epinmux data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47141.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47141\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:55:54.896424Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-667\", \"description\": \"CWE-667 Improper Locking\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:52:20.355Z\"}}], \"cna\": {\"title\": \"pinmux: Use sequential access to access desc-\u003epinmux data\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7\", \"lessThan\": \"2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7\", \"lessThan\": \"c11e2ec9a780f54982a187ee10ffd1b810715c85\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7\", \"lessThan\": \"5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/pinctrl/core.c\", \"drivers/pinctrl/core.h\", \"drivers/pinctrl/pinmux.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.66\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/pinctrl/core.c\", \"drivers/pinctrl/core.h\", \"drivers/pinctrl/pinmux.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b\"}, {\"url\": \"https://git.kernel.org/stable/c/c11e2ec9a780f54982a187ee10ffd1b810715c85\"}, {\"url\": \"https://git.kernel.org/stable/c/5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npinmux: Use sequential access to access desc-\u003epinmux data\\n\\nWhen two client of the same gpio call pinctrl_select_state() for the\\nsame functionality, we are seeing NULL pointer issue while accessing\\ndesc-\u003emux_owner.\\n\\nLet\u0027s say two processes A, B executing in pin_request() for the same pin\\nand process A updates the desc-\u003emux_usecount but not yet updated the\\ndesc-\u003emux_owner while process B see the desc-\u003emux_usecount which got\\nupdated by A path and further executes strcmp and while accessing\\ndesc-\u003emux_owner it crashes with NULL pointer.\\n\\nSerialize the access to mux related setting with a mutex lock.\\n\\n\\tcpu0 (process A)\\t\\t\\tcpu1(process B)\\n\\npinctrl_select_state() {\\t\\t  pinctrl_select_state() {\\n  pin_request() {\\t\\t\\t\\tpin_request() {\\n  ...\\n\\t\\t\\t\\t\\t\\t ....\\n    } else {\\n         desc-\u003emux_usecount++;\\n    \\t\\t\\t\\t\\t\\tdesc-\u003emux_usecount \u0026\u0026 strcmp(desc-\u003emux_owner, owner)) {\\n\\n         if (desc-\u003emux_usecount \u003e 1)\\n               return 0;\\n         desc-\u003emux_owner = owner;\\n\\n  }\\t\\t\\t\\t\\t\\t}\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.66\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.5\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"3.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:53:41.578Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47141\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:53:41.578Z\", \"dateReserved\": \"2025-01-09T09:50:31.758Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-11T12:25:12.399Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.