Security readout for executives and security teams
Plain-English summary
CVE-2024-42090 is a Linux kernel bug that can cause a deadlock while setting up pin control resources. In business terms, this is mainly an availability concern: affected systems could hang in specific hardware or driver initialization paths. The sources do not show active exploitation or a public severity score.
Executive priority
Handle through normal kernel patch governance unless affected devices show instability or are operationally critical. There is no cited active exploitation, but kernel deadlocks can disrupt availability, so defer only with documented vendor risk acceptance.
Technical view
The issue is in create_pinctrl(). It holds pinctrl_maps_mutex, then calls add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(), which attempts to acquire the same mutex and can deadlock. The kernel fix releases pinctrl_maps_mutex before calling pinctrl_free().
Likely exposure
Exposure is most relevant to Linux systems using affected kernel builds and pinctrl driver paths, especially hardware-dependent environments. The bundle lists Linux kernel versions and multiple stable commits, but precise affected and fixed ranges should be confirmed against the running distribution or vendor advisory.
Exploitation context
The provided sources describe a kernel deadlock discovered by Coverity SAST. They do not provide evidence of active exploitation, public exploit availability, or inclusion in CISA KEV. Treat this as a reliability and denial-of-service risk until vendor-specific impact is confirmed.
Researcher notes
Evidence supports a mutex re-entry deadlock in the pinctrl subsystem during -EPROBE_DEFER handling. The source bundle does not include CVSS, CWE, exploitability analysis, or complete branch range semantics, so validation should rely on vendor kernel package metadata and referenced stable commits.
Mitigation direction
- Update affected Linux kernels using your distribution or device vendor guidance.
- Prioritize systems where pinctrl drivers are relevant to boot or device initialization.
- Review Debian LTS and Siemens advisories if those ecosystems apply.
- Schedule required reboots after kernel package updates.
- Track kernel stable fixes referenced for your maintained branch.
Validation and detection
- Inventory running kernel versions across servers, appliances, and embedded devices.
- Map each kernel to vendor advisories or stable fix commits.
- Confirm updated packages include the CVE-2024-42090 fix.
- Check whether affected systems use relevant pinctrl paths or hardware drivers.
- Monitor for boot-time or driver-probe hangs before and after patching.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42090 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e65a0dc2e85efb28e182aca50218e8a056d0ce04CVE reference, Linux
- https://git.kernel.org/stable/c/420ce1261907e5dbeda1e4daffd5b6c76f8188c0CVE reference, Linux
- https://git.kernel.org/stable/c/b813e3fd102a959c5b208ed68afe27e0137a561bCVE reference, Linux
- https://git.kernel.org/stable/c/01fe2f885f7813f8aed5d3704b384a97b1116a9eCVE reference, Linux
- https://git.kernel.org/stable/c/b36efd2e3e22a329444b6b24fa48df6d20ae66e6CVE reference, Linux
- https://git.kernel.org/stable/c/4038c57bf61631219b31f1bd6e92106ec7f084dcCVE reference, Linux
- https://git.kernel.org/stable/c/48a7a7c9571c3e62f17012dd7f2063e926179dddCVE reference, Linux
- https://git.kernel.org/stable/c/adec57ff8e66aee632f3dd1f93787c13d112b7a1CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.