---
id: CVE-2024-47141
title: 'pinmux: Use sequential access to access desc->pinmux data'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  pinmux: Use sequential access to access desc->pinmux data

  When two client of the same gpio call pinctrl_select_state() for the
  same functionality, we are seeing NULL p…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 <
    d25e45dcf8e32062f7935e4ba154869043812ab6
  - >-
    Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 <
    2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b
  - >-
    Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 <
    c11e2ec9a780f54982a187ee10ffd1b810715c85
  - >-
    Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 <
    5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e
  - Linux 3.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-10-01T19:55:54.896424Z'
published: '2025-01-11'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:19:25.504Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-47141'
references:
  - url: 'https://git.kernel.org/stable/c/d25e45dcf8e32062f7935e4ba154869043812ab6'
  - url: 'https://git.kernel.org/stable/c/2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b'
  - url: 'https://git.kernel.org/stable/c/c11e2ec9a780f54982a187ee10ffd1b810715c85'
  - url: 'https://git.kernel.org/stable/c/5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e'
tags:
  - cve.org
epss: 0.00174
epssPercentile: 0.06936
ingestedAt: '2026-11-03T13:45:42.695Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

pinmux: Use sequential access to access desc->pinmux data

When two client of the same gpio call pinctrl_select_state() for the
same functionality, we are seeing NULL pointer issue while accessing
desc->mux_owner.

Let's say two processes A, B executing in pin_request() for the same pin
and process A updates the desc->mux_usecount but not yet updated the
desc->mux_owner while process B see the desc->mux_usecount which got
updated by A path and further executes strcmp and while accessing
desc->mux_owner it crashes with NULL pointer.

Serialize the access to mux related setting with a mutex lock.

	cpu0 (process A)			cpu1(process B)

pinctrl_select_state() {		  pinctrl_select_state() {
  pin_request() {				pin_request() {
  ...
						 ....
    } else {
         desc->mux_usecount++;
    						desc->mux_usecount && strcmp(desc->mux_owner, owner)) {

         if (desc->mux_usecount > 1)
               return 0;
         desc->mux_owner = owner;

  }						}

## Affected

- `Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < d25e45dcf8e32062f7935e4ba154869043812ab6`
- `Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b`
- `Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < c11e2ec9a780f54982a187ee10ffd1b810715c85`
- `Linux >= 42fed7ba44e4e8c1fb27b28ad14490cb1daff3c7 < 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e`
- `Linux 3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.