Description
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: x86-android-tablets: Unregister devices in reverse order
Not all subsystems support a device getting removed while there are
still consumers of the device with a reference to the device.
One example of this is the regulator subsystem. If a regulator gets
unregistered while there are still drivers holding a reference
a WARN() at drivers/regulator/core.c:5829 triggers, e.g.:
WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulator_unregister
Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 04/10/2015
RIP: 0010:regulator_unregister
Call Trace:
<TASK>
regulator_unregister
devres_release_group
i2c_device_remove
device_release_driver_internal
bus_remove_device
device_del
device_unregister
x86_android_tablet_remove
On the Lenovo Yoga Tablet 2 series the bq24190 charger chip also provides
a 5V boost converter output for powering USB devices connected to the micro
USB port, the bq24190-charger driver exports this as a Vbus regulator.
On the 830 (8") and 1050 ("10") models this regulator is controlled by
a platform_device and x86_android_tablet_remove() removes platform_device-s
before i2c_clients so the consumer gets removed first.
But on the 1380 (13") model there is a lc824206xa micro-USB switch
connected over I2C and the extcon driver for that controls the regulator.
The bq24190 i2c-client *must* be registered first, because that creates
the regulator with the lc824206xa listed as its consumer. If the regulator
has not been registered yet the lc824206xa driver will end up getting
a dummy regulator.
Since in this case both the regulator provider and consumer are I2C
devices, the only way to ensure that the consumer is unregistered first
is to unregister the I2C devices in reverse order of in which they were
created.
For consistency and to avoid similar problems in the future change
x86_android_tablet_remove() to unregister all device types in reverse
order.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.17 | 6.1.191 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.9.7-1 | — |
| Debian 13 | linux | 6.9.7-1 | — |
| Debian 12 | linux | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux | 6.8.0-44.44 | USN-6999-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1015.16 | USN-6999-1 |
| Ubuntu 24.04 LTS | linux-gcp +1 | 6.8.0-1014.16 | USN-7004-1, USN-6999-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1010.13 | USN-6999-1 |
| Ubuntu 24.04 LTS | linux-ibm +2 | 6.8.0-1012.12 | USN-6999-1 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1013.14 | USN-7005-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1013.14.1 | USN-7005-1 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1011.12 | USN-6999-2 |
| Ubuntu 24.04 LTS | linux-riscv +1 | 6.8.0-44.44.1 | USN-6999-1 |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1015.16~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-gcp-6.8 +1 | 6.8.0-1014.16~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-45.45~22.04.1 | USN-7029-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 +1 | 6.8.0-1012.12~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-nvidia-6.8 | 6.8.0-1013.14~22.04.1 | USN-7005-2 |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv-6.8 +1 | 6.8.0-44.44.1~22.04.1 | USN-7008-1 |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2010.10 | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1008.8 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1008.8~22.04.1 | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | 6.8.0-78.78+fips1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | kernel-64kb +5 | 6.4.0-150600.23.17.1 | SUSE-SU-2024:2802-1 |
| SLES 15 SP6 | kernel-azure +1 | 6.4.0-150600.8.8.2 | SUSE-SU-2024:2896-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.17.1.150600.12.6.2 | SUSE-SU-2024:2802-1 |
| SLES 15 SP6 | kernel-docs | 6.4.0-150600.23.17.3 | SUSE-SU-2024:2802-1 |
| SLES 15 SP6 | kernel-syms-azure | 6.4.0-150600.8.8.1 | SUSE-SU-2024:2896-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | kernel-default-base | 6.4.0-17.1.1.51 | SUSE-SU-2025:20008-1 |
| SLE Micro 6.0 | kernel-rt +1 | 6.4.0-9.1 | SUSE-SU-2025:20028-1 |
| SLE Micro 6.0 | kernel-source +2 | 6.4.0-18.1 | SUSE-SU-2025:20008-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.17.1 | SUSE-SU-2024:2802-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_1 | 1-150600.1.5.1 | SUSE-SU-2024:2973-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_3 | 1-150600.13.3.1 | SUSE-SU-2024:2802-1 |
| SUSE Real Time Module 15 SP6 | kernel-rt +3 | 6.4.0-150600.10.5.1 | SUSE-SU-2024:2973-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | dtb-aarch64 +9 | 6.4.0-150600.23.17.1 | SUSE-SU-2024:2802-1 |
| openSUSE Leap 15.6 | kernel-azure +1 | 6.4.0-150600.8.8.2 | SUSE-SU-2024:2896-1 |
| openSUSE Leap 15.6 | kernel-default-base | 6.4.0-150600.23.17.1.150600.12.6.2 | SUSE-SU-2024:2802-1 |
| openSUSE Leap 15.6 | kernel-docs | 6.4.0-150600.23.17.3 | SUSE-SU-2024:2802-1 |
| openSUSE Leap 15.6 | kernel-rt +3 | 6.4.0-150600.10.5.1 | SUSE-SU-2024:2973-1 |
| openSUSE Leap 15.6 | kernel-syms-azure | 6.4.0-150600.8.8.1 | SUSE-SU-2024:2896-1 |
Advisories 13
- WID-SEC-2024-1607 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2026
- USN-6999-1 linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oem-6.8, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7029-1 linux-hwe-6.8 Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7005-1 linux-nvidia, linux-nvidia-lowlatency vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7004-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7005-2 linux-nvidia-6.8 vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7008-1 linux-lowlatency-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-6999-2 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- SUSE-SU-2025:20008-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20028-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2024:2973-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2896-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2802-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · May 2, 2025