CVE-2024-49961

What it actually does

The ar0521 driver calls the non-sleeping gpiod_set_value() from ar0521_power_on()/ar0521_power_off() even when the reset GPIO is supplied by an I2C port expander, violating the GPIO API contract and producing a warning in gpiolib.

Why it matters to the business

Low-severity operational noise and potential probe delays on embedded systems using the AR0521 sensor behind I2C GPIO expanders; broad Linux distributions carry the defect until updated.

How an attack unfolds

The flaw is a correctness bug, not a security vulnerability. No public exploits or threat-actor campaigns target it; exploitation is not feasible because the only observable effect is a kernel warning during device power sequencing.

How to fix it

Upgrade the kernel to commit 9f08876d766755a92f1b9543ae3ee21bfc596fb8 or install the Rocky Linux 8 module updates listed for each affected package (libvirt 0:6.0.0-35, qemu-kvm 5:4.2.0-48, libguestfs 1:1.40.2-27, etc.).

How to confirm the fix worked

Confirm the running kernel contains commit 9f08876d766755a92f1b9543ae3ee21bfc596fb8; boot an affected system with the AR0521 sensor behind an I2C expander and verify absence of the gpiod_set_value warning during deferred probe.

How to detect it

Search kernel logs and dmesg for the exact warning string "WARNING: .* gpiod_set_value" together with the call trace containing ar0521_power_on; correlate with hardware containing the AR0521 sensor and I2C expanders.

What your security team should do

• Apply the listed Rocky Linux module updates or the referenced kernel commit on all affected hosts
• Rebuild and redeploy any downstream kernel packages that embed the ar0521 driver
• Review kernel logs after update to confirm the warning no longer occurs