CVE-2024-46846

What it actually does

Unbalanced runtime PM and system PM handling in the Rockchip SPI driver causes double clock disable during system suspend when the device is already runtime-suspended, triggering warnings and potential instability.

Why it matters to the business

May produce kernel warnings or reduced reliability during suspend/resume cycles on systems using Rockchip SPI hardware, with low immediate operational disruption given stable low exploitability metrics and no known ransomware usage.

How an attack unfolds

An attacker with local access could trigger repeated runtime suspend followed by system suspend cycles on affected Rockchip hardware to induce warnings or instability; no widespread exploitation observed despite mentions in generic Linux kernel campaigns.

How to fix it

Upgrade the Linux kernel to a version containing commit 14f970a8d03d882b15b97beb83bd84ac8ba6298c or later; apply the same fix to any downstream stable trees listed in the fixed_versions field.

How to confirm the fix worked

Confirm kernel source contains the pm_runtime_force_suspend/resume calls and refactored resume error handling; test full suspend/resume cycles on Rockchip hardware and verify absence of double-disable warnings.

Typical attack path

1. Gain local access to a Linux system with Rockchip SPI controller
2. Force runtime suspend of the SPI device
3. Initiate system-wide suspend via NOIRQ_SYSTEM_SLEEP_PM path
4. Observe resulting clock-disable warnings or driver errors

How to detect it

Search kernel logs and dmesg for Rockchip SPI runtime PM warnings or clock-disable messages during system suspend; correlate with pm_runtime and NOIRQ_SYSTEM_SLEEP_PM activity.

• spi: rockchip: double-disable clocks
• unbalanced runtime PM / system PM handling
• WARN_ON in rockchip_spi_runtime_pm

What your security team should do

• Apply the referenced upstream commit or distribution kernel update within normal patching windows
• Monitor kernel logs for Rockchip SPI PM warnings during suspend testing
• Prioritize updates on embedded or server fleets using Rockchip SPI controllers