CVE-2024-36029

What it actually does

The sdhci-msm driver fails to set the host->runtime_suspended flag that generic SDHCI LED handling code relies on, allowing LED device access to proceed while the controller is runtime suspended and triggering a crash.

Why it matters to the business

Systems using Qualcomm MSM SDHCI controllers may experience unexpected crashes during routine LED or power-management operations, leading to downtime on affected Linux and Android devices until kernels are updated.

How an attack unfolds

An attacker with local access triggers runtime suspend of the SDHCI controller and then causes the generic SDHCI LED code path to execute, resulting in a crash due to the missing suspended flag. The listed threat actor context points to Android kernel scenarios but this specific flaw manifests as a denial-of-service rather than remote code execution.

How to fix it

Update the Linux kernel to a version containing commit 1200481cd6069d16ce20133bcd86f5825e26a045 or later; rebuild and deploy the fixed kernel image on all affected devices.

How to confirm the fix worked

Confirm the running kernel contains commit 1200481cd6069d16ce20133bcd86f5825e26a045; test LED access while the controller is runtime suspended and verify no crash occurs.

Typical attack path

1. Obtain local execution on a system with sdhci-msm hardware
2. Trigger runtime suspend of the SDHCI controller
3. Access the registered LED device which invokes unprotected controller operations
4. Induce kernel crash due to missing runtime_suspended protection

How to detect it

Review kernel crash logs and dmesg output for SDHCI or LED-related faults occurring during runtime suspend transitions; examine boot and suspend/resume logs for timing of controller state changes.

What your security team should do

• Prioritize kernel updates on all devices using sdhci-msm controllers within the next patching cycle
• Monitor vendor advisories for backported fixes in distribution kernels
• Test power-management and LED functionality after applying the update