CVE-2024-35986

What it actually does

Use-after-free caused by a dangling reference to a power_supply device that is unregistered while the tusb1210 charger-detect code still holds a reference, leading to a crash on subsequent calls to tusb1210_get_online.

Why it matters to the business

Kernel instability or crashes on affected Linux systems using the tusb1210 USB PHY driver, particularly during driver unload or charger power supply changes, increasing downtime risk for embedded and Android devices.

How an attack unfolds

An attacker with local access or the ability to trigger module unload and power_supply unregistration can force the race condition that leaves a freed pointer, resulting in a crash on the next charger status query; theoretical race remains after the partial fix.

How to fix it

Update the Linux kernel to a version containing commit 25b3498485ac281e5851700e33b97f12c9533fd8 which limits the reference lifetime to the duration of tusb1210_get_online.

How to confirm the fix worked

Confirm the presence of commit 25b3498485ac281e5851700e33b97f12c9533fd8 in the kernel source or verify that power_supply_unregister no longer produces the use-count warning when tusb1210 is active.

Typical attack path

1. Obtain ability to load/unload kernel modules or unregister power_supply devices
2. Trigger tusb1210_get_online to acquire reference
3. Unregister the charger power_supply while reference is held
4. Call tusb1210_get_online again to dereference freed memory and crash

How to detect it

Search kernel logs and crash dumps for references to tusb1210_get_online, power_supply_unregister use-count warnings, and dangling power_supply references around module unload events.

• tusb1210_get_online
• WARN_ON(atomic_dec_return(&psy->use_cnt))
• power_supply_unregister
• dangling reference.*charger

What your security team should do

• Apply the referenced kernel commit or newer stable branch immediately on systems exposing the tusb1210 PHY
• Monitor kernel logs for power_supply use-count warnings and tusb1210 crashes
• Restrict local module loading privileges until patched