VYPR
← All advisories
High severity7.8NVD Advisory· Published Aug 17, 2024· Updated May 12, 2026

CVE-2024-43830

CVE-2024-43830

Description

In the Linux kernel, the following vulnerability has been resolved:

leds: trigger: Unregister sysfs attributes before calling deactivate()

Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the activate() callback and freed by the deactivate() callback.

Calling device_remove_groups() after calling deactivate() leaves a window where the sysfs attributes show/store functions could be called after deactivation and then operate on the just freed trigger-data.

Move the device_remove_groups() call to before deactivate() to close this race window.

This also makes the deactivation path properly do things in reverse order of the activation path which calls the activate() callback before calling device_add_groups().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A race condition in the Linux kernel's LED trigger sysfs cleanup allows use-after-free of trigger data, potentially leading to privilege escalation. Patched.

Vulnerability

A race condition exists in the Linux kernel's LED trigger subsystem where sysfs attributes are removed after calling the deactivate() trigger callback. This leaves a window where the sysfs show/store functions can be invoked after the trigger data has been freed, leading to a use-after-free.

Exploitation

The bug is triggered when a LED trigger with custom sysfs attributes is deactivated concurrently while the sysfs interface is accessed. A local attacker with ability to deactivate triggers (e.g., via sysfs write) and race with another process reading or writing the attributes could trigger the use-after-free.

Impact

A successful exploit could allow a local attacker to execute arbitrary code or cause a denial of service, potentially escalating privileges. The vulnerability affects the Linux kernel and products using it, such as Siemens SIMATIC S7-1500 TM MFP devices [1].

Mitigation

The fix reorders the cleanup to call device_remove_groups() before deactivate(), ensuring sysfs access is blocked before data is freed. The patch has been backported to stable kernel versions. Siemens recommends updating affected device firmware to address this and other CVEs [1].

References
  1. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

123

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.