Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2024-46846: Linux kernel rockchip SPI driver can trigger warnings on sleep
CVE-2024-46846 · published 2 years ago
Summary
The rockchip SPI driver in the Linux kernel may turn off its clocks twice when a computer goes to sleep, especially if the device was already in a low‑power state. This creates warning messages that can indicate a problem but does not normally affect functionality. Updating the kernel to the latest version or applying the provided patch will correct the power‑management handling.
What to do
- Update debian linux to version 6.1.112-1.
- Update debian linux to version 6.10.11-1.
- Update linux kernel to version 6.10.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 5.18, < 6.1.110 >= 6.2, < 6.6.51 >= 6.7, < 6.10.10 6.11 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Debian:12 | debian | linux |
< 6.1.112-1 Fix: upgrade to 6.1.112-1
|
| Debian:13 | debian | linux |
< 6.10.11-1 Fix: upgrade to 6.10.11-1
|
| Linux | linux | kernel |
>= 6.7.0, < 6.10.10 Fix: upgrade to 6.10.10
|
Original advisory text
spi: rockchip: Resolve unbalanced runtime PM / system PM handling
In the Linux kernel, the following vulnerability has been resolved: spi: rockchip: Resolve unbalanced runtime PM / system PM handling Commit e882575efc77 ("spi: rockchip: Suspend and resume the bus during NOIRQ_SYSTEM_SLEEP_PM ops") stopped respecting runtime PM status and simply disabled clocks unconditionally when suspending the system. This causes problems when the device is already runtime suspended when we go to sleep -- in which case we double-disable clocks and produce a WARNing. Switch back to pm_runtime_force_{suspend,resume}(), because that still seems like the right thing to do, and the aforementioned commit makes no explanation why it stopped using it. Also, refactor some of the resume() error handling, because it's not actually a good idea to re-disable clocks on failure.
References
- https://git.kernel.org/stable/c/0efbad8445fbba7896402500a1473450a299a08a URL
- https://git.kernel.org/stable/c/14f970a8d03d882b15b97beb83bd84ac8ba6298c URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46846... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-46846 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://security-tracker.debian.org/tracker/CVE-2024-46846 Vendor Advisory
- https://git.kernel.org/stable/c/d034bff62faea1a2219e0d2f3d17263265f24087 URL
- https://git.kernel.org/stable/c/be721b451affbecc4ba4eaac3b71cdbdcade1b1b URL
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Timeline
Published27 Sep 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta