CVE-2024-39484

What it actually does

The davinci_mmc driver marks its remove callback with __exit, causing it to be discarded at link time when CONFIG_MMC_DAVINCI=y. Unbinding the device therefore skips all cleanup, leaving allocated resources (clocks, IRQs, DMA mappings) in use and producing a resource leak.

Why it matters to the business

Systems using the builtin davinci MMC driver may experience gradual resource exhaustion or unexpected behavior after device removal or hot-unplug events, increasing the chance of service disruption on affected embedded or server platforms.

How an attack unfolds

An attacker with local access triggers device unbind via sysfs or a hotplug event. Because the remove handler is absent, the driver exits without releasing hardware resources, leaving the system in a partially initialized state that can be leveraged for denial-of-service or, in combination with other kernel flaws, further attacks.

How to fix it

Upgrade the Linux kernel to a revision containing commit 60b341b778cc2929df16c0a504c91621b3c6a4ad (or later equivalent backport) so the remove callback is compiled unconditionally. Rebuild and reboot with the corrected driver.

How to confirm the fix worked

Confirm the running kernel contains commit 60b341b778cc2929df16c0a504c91621b3c6a4ad; verify that modpost no longer emits the section-mismatch warning for davinci_mmcsd_driver and that unbind operations complete without resource warnings in dmesg.

Typical attack path

1. Obtain local shell or equivalent on a system with CONFIG_MMC_DAVINCI=y
2. Locate the davinci MMC device via sysfs or udev
3. Write to the device's unbind attribute or simulate hot-unplug
4. Observe that davinci_mmcsd_remove is never called and resources remain allocated
5. Repeat or combine with other actions to amplify resource pressure or trigger secondary faults

How to detect it

Review kernel logs for repeated unbind events on davinci_mmc devices without corresponding remove-function output; look for increasing counts of unreleased IRQs, DMA channels, or clock references associated with the MMC controller after hot-unplug operations.

What your security team should do

• Prioritize kernel update on all systems that build davinci_mmc as a built-in module
• Add the fixed commit hash to automated kernel-build and CI checks
• Monitor dmesg and resource accounting for signs of leaks after device removal events