CVE-2024-49961

media: i2c: ar0521: Use cansleep version of gpiod_set_value()

MEDIUM
5.5
CVSS Score
Published: October 21, 2024 at 06:02 PM UTC
Updated: June 17, 2026 at 08:00 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ar0521: Use cansleep version of gpiod_set_value() If we use GPIO reset from I2C port expander, we must use *_cansleep() variant of GPIO functions. This was not done in ar0521_power_on()/ar0521_power_off() functions. Let's fix that. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x74/0x7c Modules linked in: CPU: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.10.0 #53 Hardware name: Diasom DS-RK3568-SOM-EVB (DT) Workqueue: events_unbound deferred_probe_work_func pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : gpiod_set_value+0x74/0x7c lr : ar0521_power_on+0xcc/0x290 sp : ffffff8001d7ab70 x29: ffffff8001d7ab70 x28: ffffff80027dcc90 x27: ffffff8003c82000 x26: ffffff8003ca9250 x25: ffffffc080a39c60 x24: ffffff8003ca9088 x23: ffffff8002402720 x22: ffffff8003ca9080 x21: ffffff8003ca9088 x20: 0000000000000000 x19: ffffff8001eb2a00 x18: ffffff80efeeac80 x17: 756d2d6332692f30 x16: 0000000000000000 x15: 0000000000000000 x14: ffffff8001d91d40 x13: 0000000000000016 x12: ffffffc080e98930 x11: ffffff8001eb2880 x10: 0000000000000890 x9 : ffffff8001d7a9f0 x8 : ffffff8001d92570 x7 : ffffff80efeeac80 x6 : 000000003fc6e780 x5 : ffffff8001d91c80 x4 : 0000000000000002 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001 Call trace: gpiod_set_value+0x74/0x7c ar0521_power_on+0xcc/0x290 ...

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.0 ≤ v < 6.1.1136.0 ≤ v < 6.10.146.0 ≤ v < 6.11.36.0 ≤ v < 6.126.0 ≤ v < 6.6.556.11 ≤ v < 6.11.36.2 ≤ v < 6.6.556.7 ≤ v < 6.10.146.0852b50aeed153b513c0b36298559114fab0fab80
Vendor states this is fixed in 2423b60a2d6d27e5f66c5021b494463aef2db212 (fixed)
Vendor states this is fixed in 3cf00ecfbf11ee8e6afff306a5bdcff4bf95d2cf (fixed)
Vendor states this is fixed in 625a77b68c96349c16fcc1faa42784313e0b1a85 (fixed)
Vendor states this is fixed in 9f08876d766755a92f1b9543ae3ee21bfc596fb8 (fixed)
Vendor states this is fixed in bee1aed819a8cda47927436685d216906ed17f62 (fixed)
Vendor states this is fixed in 6.0 (unaffected)
Vendor states this is fixed in 6.1.113 (unaffected)
Vendor states this is fixed in 6.10.14 (unaffected)
Vendor states this is fixed in 6.11.3 (unaffected)
Vendor states this is fixed in 6.12 (unaffected)
Vendor states this is fixed in 6.6.55 (unaffected)

References (6)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2423b60a2d6d27e5f66c5021b494463aef2db212
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3cf00ecfbf11ee8e6afff306a5bdcff4bf95d2cf
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/625a77b68c96349c16fcc1faa42784313e0b1a85
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9f08876d766755a92f1b9543ae3ee21bfc596fb8
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/bee1aed819a8cda47927436685d216906ed17f62
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card