CVE-2024-53134

What it actually does

Incorrect loop condition in imx93-blk-ctrl remove path causes infinite loop and kernel panic; also leaves unbalanced runtime PM enable call.

Why it matters to the business

Systems using affected i.MX93 hardware may experience unexpected crashes during driver unload or power-management transitions, leading to downtime and potential data loss on embedded or automotive devices.

How an attack unfolds

An attacker with local access triggers the driver's remove path (via module unload or device removal) on vulnerable kernels; the flawed loop never terminates, resulting in panic. Generic kernel exploitation campaigns could leverage similar patterns but no targeted actors are tied to this specific flaw.

How to fix it

Update to a kernel containing commit 8fc228ab5d38a026eae7183a5f74a4fac43d9b6a or later stable release that corrects the loop condition and adds the missing runtime PM disable call.

How to confirm the fix worked

Verify the presence of the corrected loop condition (i < bc->onecell_data.num_domains) and balanced pm_runtime calls in the imx93-blk-ctrl source; confirm kernel version or git commit after patching and test module load/unload cycles.

Typical attack path

1. Obtain local access or ability to unload the imx93-blk-ctrl driver
2. Trigger device removal or module unload sequence
3. Exploit infinite loop in remove callback to induce kernel panic

How to detect it

Review kernel logs for oops or panic messages mentioning imx93-blk-ctrl and unbalanced pm_runtime_enable; inspect dmesg or journalctl around device removal events.

What your security team should do

• Prioritize patching embedded Linux systems using i.MX93 hardware
• Apply the fixed commit or newer stable kernel branch
• Monitor for kernel oops or panic logs referencing imx93-blk-ctrl during driver removal