CVE-2024-42090

What it actually does

Deadlock in Linux kernel pinctrl subsystem when create_pinctrl() holds pinctrl_maps_mutex and add_setting() returns -EPROBE_DEFER, causing pinctrl_free() to attempt re-acquisition of the same mutex.

Why it matters to the business

Linux systems may experience kernel deadlocks leading to system hangs, unresponsive devices, or denial of service during driver probing, affecting stability across servers, embedded devices, and desktops using affected kernel versions.

How an attack unfolds

A local attacker with low privileges triggers device probe sequences that return -EPROBE_DEFER (such as during module loading or hardware initialization) to force the mutex acquisition conflict and induce a deadlock; listed threat actors have targeted similar Linux kernel resource issues in espionage and financially motivated campaigns.

How to fix it

Upgrade the Linux kernel to a version containing commit e65a0dc2e85efb28e182aca50218e8a056d0ce04 or later stable releases; rebuild and reboot all affected systems.

How to confirm the fix worked

Confirm kernel source contains the mutex release before pinctrl_free() call in create_pinctrl(); verify running kernel version matches a fixed release and test device probe paths for absence of deadlock.

Typical attack path

1. Obtain local access on a Linux system running a vulnerable kernel
2. Trigger pinctrl device registration or driver probe that returns -EPROBE_DEFER
3. Force create_pinctrl() to hold pinctrl_maps_mutex while pinctrl_free() attempts acquisition
4. Cause kernel deadlock resulting in system unresponsiveness

How to detect it

Review kernel logs for deadlock warnings or mutex contention during pinctrl initialization; examine dmesg and syslog for repeated probe deferral patterns around pinctrl calls.

What your security team should do

• Prioritize kernel upgrades on all production Linux systems before the CISA-style deadlines if applicable
• Monitor for kernel oops or hang reports in system logs during driver initialization
• Apply the fix via distribution updates and validate with regression testing on pinctrl-dependent hardware