CVE-2024-40975 in Linux
Summary
by MITRE • 07/12/2024
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: x86-android-tablets: Unregister devices in reverse order
Not all subsystems support a device getting removed while there are still consumers of the device with a reference to the device.
One example of this is the regulator subsystem. If a regulator gets unregistered while there are still drivers holding a reference a WARN() at drivers/regulator/core.c:5829 triggers, e.g.:
WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulator_unregister Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 04/10/2015 RIP: 0010:regulator_unregister Call Trace: regulator_unregister devres_release_group i2c_device_remove device_release_driver_internal bus_remove_device device_del device_unregister x86_android_tablet_remove
On the Lenovo Yoga Tablet 2 series the bq24190 charger chip also provides a 5V boost converter output for powering USB devices connected to the micro USB port, the bq24190-charger driver exports this as a Vbus regulator.
On the 830 (8") and 1050 ("10") models this regulator is controlled by a platform_device and x86_android_tablet_remove() removes platform_device-s before i2c_clients so the consumer gets removed first.
But on the 1380 (13") model there is a lc824206xa micro-USB switch connected over I2C and the extcon driver for that controls the regulator. The bq24190 i2c-client *must* be registered first, because that creates the regulator with the lc824206xa listed as its consumer. If the regulator has not been registered yet the lc824206xa driver will end up getting a dummy regulator.
Since in this case both the regulator provider and consumer are I2C devices, the only way to ensure that the consumer is unregistered first is to unregister the I2C devices in reverse order of in which they were created.
For consistency and to avoid similar problems in the future change x86_android_tablet_remove() to unregister all device types in reverse order.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2025
The vulnerability identified as CVE-2024-40975 affects the Linux kernel's handling of device removal in specific x86 Android tablet platforms, particularly those using the x86_android_tablet driver. This issue manifests when platform devices and I2C clients are removed from the system, creating a scenario where subsystems like the regulator subsystem cannot properly handle device unregistration while consumers still maintain references to the device. The problem specifically impacts the Lenovo Yoga Tablet 2 series, where different model variants exhibit distinct hardware configurations that influence the order of device registration and unregistration. The root cause stems from improper device removal sequencing in the x86_android_tablet_remove() function, which fails to maintain consistent ordering across all device types during system shutdown or device removal operations.
The technical flaw occurs within the platform/x86 subsystem of the Linux kernel where the x86_android_tablet_remove() function processes device removal in a non-reversed order. When a platform device is unregistered before its corresponding I2C client devices, it creates a race condition that triggers kernel warnings in the regulator subsystem. Specifically, when the bq24190 charger chip's regulator is unregistered while I2C clients that depend on it are still active, the kernel's regulator_unregister function at drivers/regulator/core.c:5829 generates a WARNING message. This behavior follows CWE-129, which addresses improper handling of resource references in kernel space, and directly relates to improper device lifecycle management within embedded systems. The regulator subsystem's design requires that consumers be unregistered before providers, but the current implementation fails to maintain this dependency order across different device types.
The operational impact of this vulnerability extends beyond simple kernel warnings to potentially cause system instability and device malfunction in affected Android tablet platforms. When the regulator subsystem receives a warning due to improper device removal order, it indicates a deeper issue with the device management framework that could lead to resource leaks or failed device operations. The vulnerability affects specific Lenovo Yoga Tablet 2 variants with different screen sizes, where the hardware configuration determines whether the bq24190 regulator is controlled by platform devices or I2C clients. This inconsistency creates a scenario where the 1380 model (13") experiences the problematic behavior due to its specific hardware arrangement with the lc824206xa micro-USB switch connected over I2C, while other models may not exhibit the same issues. The vulnerability also aligns with ATT&CK technique T1547.001, which involves persistence mechanisms through kernel modules, as improper device handling can affect system stability and device functionality.
The mitigation strategy for this vulnerability requires implementing a consistent device removal order within the x86_android_tablet_remove() function. The solution involves unregistering all device types in reverse order of their creation, ensuring that I2C clients are removed before platform devices when both types are present. This approach addresses the fundamental issue of dependency management between device providers and consumers within the Linux kernel's device model. The fix ensures that when the regulator subsystem handles device removal, all consumers are properly unregistered before the provider is removed, preventing the kernel warnings and potential system instability. This remediation follows established kernel development practices for managing device lifecycle operations and aligns with industry standards for embedded system device management. The solution also helps prevent similar vulnerabilities in the future by establishing a consistent pattern for device removal that accounts for subsystem dependencies and resource reference management across different device types within the same platform.