Skip to content
OpenAdvisories
Unscored CVE-2024-44937 EUVD-2024-41149GHSA-w3ph-7hx8-wxg6

platform/x86: intel-vbtn: Protect ACPI notify handler against recursion

Published Aug 26, 2024 · Updated May 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: intel-vbtn: Protect ACPI notify handler against recursion

Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on
all CPUs") ACPI notify handlers like the intel-vbtn notify_handler() may
run on multiple CPU cores racing with themselves.

This race gets hit on Dell Venue 7140 tablets when undocking from
the keyboard, causing the handler to try and register priv->switches_dev
twice, as can be seen from the dev_info() message getting logged twice:

[ 83.861800] intel-vbtn INT33D6:00: Registering Intel Virtual Switches input-dev after receiving a switch event
[ 83.861858] input: Intel Virtual Switches as /devices/pci0000:00/0000:00:1f.0/PNP0C09:00/INT33D6:00/input/input17
[ 83.861865] intel-vbtn INT33D6:00: Registering Intel Virtual Switches input-dev after receiving a switch event

After which things go seriously wrong:
[ 83.861872] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:1f.0/PNP0C09:00/INT33D6:00/input/input17'
...
[ 83.861967] kobject: kobject_add_internal failed for input17 with -EEXIST, don't try to register things with the same name in the same directory.
[ 83.877338] BUG: kernel NULL pointer dereference, address: 0000000000000018
...

Protect intel-vbtn notify_handler() from racing with itself with a mutex
to fix this.

Affected products

VendorProductAffectedFixed
Linux Linux 6.8 6.10.5

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.10.6-1 —
Debian 13 linux 6.10.6-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux 6.8.0-50.51 USN-7154-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1020.22 USN-7154-1
Ubuntu 24.04 LTS linux-azure 6.8.0-1020.23 USN-7196-1
Ubuntu 24.04 LTS linux-gcp +1 6.8.0-1019.21 USN-7155-1, USN-7154-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1015.19 USN-7154-1
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1002.4 USN-7156-1
Ubuntu 24.04 LTS linux-ibm 6.8.0-1017.17 USN-7154-1
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1019.21.1 USN-7155-1
Ubuntu 24.04 LTS linux-oem-6.8 6.8.0-1018.18 USN-7154-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1017.18 USN-7154-1
Ubuntu 24.04 LTS linux-raspi 6.8.0-1016.18 USN-7154-1
Ubuntu 24.04 LTS linux-riscv +1 6.8.0-50.51.1 USN-7154-1
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1020.22~22.04.1 USN-7154-1
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1020.23~22.04.1 USN-7196-1
Ubuntu 22.04 LTS linux-gcp-6.8 +1 6.8.0-1019.21~22.04.1 USN-7155-1, USN-7154-1
Ubuntu 22.04 LTS linux-hwe-6.8 6.8.0-50.51~22.04.1 USN-7154-2
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1017.18~22.04.1 USN-7154-1
Ubuntu 22.04 LTS linux-riscv +31 No fix yet —
Ubuntu 22.04 LTS linux-riscv-6.8 +1 6.8.0-50.51.1~22.04.1 USN-7154-1
Ubuntu 20.04 LTS linux-gke +26 No fix yet —
Ubuntu 18.04 LTS linux-gcp +13 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2015.16 —
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1013.14 —

Advisories 6

References