{"id":"CVE-2024-47141","title":"pinmux: Use sequential access to access desc->pinmux data","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npinmux: Use sequential access to access desc->pinmux data\n\nWhen two client of the same gpio call pinctrl_select_state() for the\nsame functionality, we are seeing NULL p…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"adp","vendor":"Linux","product":"Linux","affected":["Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < d25e45dcf8e32062f7935e4ba154869043812ab6","Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b","Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < c11e2ec9a780f54982a187ee10ffd1b810715c85","Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e","Linux 3.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2025-10-01T19:55:54.896424Z"},"published":"2025-01-11","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:19:25.504Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-47141","references":[{"url":"https://git.kernel.org/stable/c/d25e45dcf8e32062f7935e4ba154869043812ab6"},{"url":"https://git.kernel.org/stable/c/2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b"},{"url":"https://git.kernel.org/stable/c/c11e2ec9a780f54982a187ee10ffd1b810715c85"},{"url":"https://git.kernel.org/stable/c/5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e"}],"tags":["cve.org"],"epss":0.00174,"epssPercentile":0.06936,"ingestedAt":"2026-11-03T13:45:42.695Z","slug":"CVE-2024-47141","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npinmux: Use sequential access to access desc->pinmux data\n\nWhen two client of the same gpio call pinctrl_select_state() for the\nsame functionality, we are seeing NULL pointer issue while accessing\ndesc->mux_owner.\n\nLet's say two processes A, B executing in pin_request() for the same pin\nand process A updates the desc->mux_usecount but not yet updated the\ndesc->mux_owner while process B see the desc->mux_usecount which got\nupdated by A path and further executes strcmp and while accessing\ndesc->mux_owner it crashes with NULL pointer.\n\nSerialize the access to mux related setting with a mutex lock.\n\n\tcpu0 (process A)\t\t\tcpu1(process B)\n\npinctrl_select_state() {\t\t  pinctrl_select_state() {\n  pin_request() {\t\t\t\tpin_request() {\n  ...\n\t\t\t\t\t\t ....\n    } else {\n         desc->mux_usecount++;\n    \t\t\t\t\t\tdesc->mux_usecount && strcmp(desc->mux_owner, owner)) {\n\n         if (desc->mux_usecount > 1)\n               return 0;\n         desc->mux_owner = owner;\n\n  }\t\t\t\t\t\t}\n\n## Affected\n\n- `Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < d25e45dcf8e32062f7935e4ba154869043812ab6`\n- `Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b`\n- `Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < c11e2ec9a780f54982a187ee10ffd1b810715c85`\n- `Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e`\n- `Linux 3.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}