CVE-2024-42319: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-42319 affects the Linux kernel's CMDQ (Command Queue) mailbox driver. The vulnerability was discovered when a WARN_ON message occurred during mtk-cmdq unbinding, specifically when pm_runtime_get_sync() returned a negative value. The issue was disclosed on August 17, 2024, and affects the MediaTek CMDQ driver implementation in the Linux kernel (NVD).

The vulnerability stems from an incorrect ordering of operations in the cmdq_probe() function. The issue occurs because devm_mbox_controller_register() is called before devm_pm_runtime_enable(), causing pm_runtime_get_sync() to be called after pm_runtime_disable() during device unbinding. This creates a race condition in the following call sequence: cmdq_mbox_shutdown -> mbox_free_channel -> mbox_controller_unregister -> __devm_mbox_controller_unregister (Kernel Commit).

When the vulnerability is triggered during device unbinding, it results in a WARN_ON message and potential system instability. The issue affects systems using the MediaTek CMDQ driver in the Linux kernel (NVD).

The vulnerability requires local access to a system using the affected MediaTek CMDQ driver and can only be triggered during device unbinding operations. There are no known reports of this vulnerability being exploited in the wild (NVD).

The issue has been fixed by moving the devm_mbox_controller_register() call after devm_pm_runtime_enable() in the cmdq_probe() function. This ensures that devm_pm_runtime_disable() is called after devm_mbox_controller_unregister(). The fix is available in the Linux kernel through commit a8bd68e4329f9a0ad1b878733e0f80be6a971649 (Kernel Commit). Users should update their Linux kernel to a version containing this fix.