Answer in brief
CVE-2024-35986 records a High severity (CVSS 7.0) vulnerability in phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | 5.18 | Not reported |
| Linux/Linuxgeneric | >=48969a5623ed918713552e2b4f9d391c89b5e838 <25b3498485ac281e5851700e33b97f12c9533fd8 || >=48969a5623ed918713552e2b4f9d391c89b5e838 <73224a5d2180066c7fe05b4656647601ba08d588 || >=48969a5623ed918713552e2b4f9d391c89b5e838 <9827caa5105fb16d1fae2e75c8d0e4662014b3ca || >=48969a5623ed918713552e2b4f9d391c89b5e838 <bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052 | 25b3498485ac281e5851700e33b97f12c9533fd8, 73224a5d2180066c7fe05b4656647601ba08d588, 9827caa5105fb16d1fae2e75c8d0e4662014b3ca, bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052 |
Published upstream
May 20, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered The power_supply frame-work is not really designed for there to be long living in kernel references to power_supply devices. Specifically unregistering a power_supply while some other code has a reference to it triggers a WARN in power_supply_unregister(): WARN_ON(atomic_dec_return(&psy->use_cnt)); Folllowed by the power_supply still getting removed and the backing data freed anyway, leaving the tusb1210 charger-detect code with a dangling reference, resulting in a crash the next time tusb1210_get_online() is called. Fix this by only holding the reference in tusb1210_get_online() freeing it at the end of the function. Note this still leaves a theoretical race window, but it avoids the issue when manually rmmod-ing the charger chip driver during development.
Quoted source text, attributed separately from HOL analysis.