CVE-2024-42129: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-42129 affects the Linux kernel's LED subsystem, specifically the mlxreg LED driver. The vulnerability was discovered in July 2024 and involves improper mutex handling in the LED driver. In this driver, LEDs are registered using devm_led_classdev_register() which automatically unregisters them after the module's remove() function is executed (Kernel Git).

The technical issue arises when led_classdev_unregister() calls the module's led_set_brightness() function to turn off the LEDs. This callback uses a mutex that was already destroyed in the module's remove() function, leading to potential synchronization issues. The fix involves using the devm_mutex_init() API instead of the standard mutex initialization to ensure proper resource management (Kernel Git).

The vulnerability affects various Linux distributions including Ubuntu 22.04 LTS, 20.04 LTS, and other versions. Multiple kernel variants are impacted, including linux-aws, linux-azure, linux-gcp, and linux-oracle (Ubuntu Security).

The vulnerability requires local access to the system and affects systems using the mlxreg LED driver. The issue is primarily related to resource management and synchronization in the kernel's LED subsystem (NVD).

The vulnerability has been fixed in multiple Linux kernel versions. For Ubuntu systems, updates are available in version 6.8.0-48.48 for Ubuntu 24.04 LTS (noble) and corresponding versions for other affected distributions. Users are advised to update their systems to the patched versions (Ubuntu Security).