CVE-2024-27002

What it actually does

The flaw creates a circular lock dependency between genpd_lock and clk_prepare_lock during Mediatek clock controller probe, allowing a deadlock when mt8183-mfgcfg interacts with generic power domains.

Why it matters to the business

Affected devices may hang or fail to complete boot, causing downtime on Mediatek hardware such as certain Chromebooks and Android platforms; low exploitability keeps overall risk limited but still requires patching for reliability.

How an attack unfolds

During normal device initialization an attacker-controlled or naturally occurring probe sequence triggers the lock inversion; the deadlock manifests without further attacker action once the faulty clk_register path executes, consistent with low EPSS and absence from KEV.

How to fix it

Update to Linux kernel versions containing the fix that performs runtime PM get early in all Mediatek clock controller probe functions; for listed vim packages on Alpine v3.18 upgrade to 9.0.1167-r0 or newer.

How to confirm the fix worked

Confirm the probe function now calls pm_runtime_get_sync before clk_register and that no deadlock occurs on MT8183/MT8192 hardware during repeated boot cycles.

Typical attack path

1. Trigger or wait for Mediatek clock controller probe during boot
2. Acquire genpd_lock in power domain work
3. Attempt clk_prepare which takes clk_prepare_lock while holding genpd_lock
4. Second CPU path acquires clk_prepare_lock then blocks on genpd_lock
5. System deadlocks and boot hangs

How to detect it

Review kernel boot logs and dmesg for deadlock traces involving genpd_power_off_work_fn and clk_register; check for repeated probe failures on mediatek clock controllers.

What your security team should do

• Apply the kernel patch or distro update immediately on all Mediatek-based systems
• Prioritize devices listed in CISA guidance if any appear in environment
• Monitor boot logs for genpd or clk_prepare lock contention warnings
• Test the updated kernel on representative hardware before wide deployment