CVE-2021-47385

What it actually does

NULL pointer dereference in the w83792d hwmon driver triggered by specific device register values satisfying (val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7)), caused by an obsolete lm75[] array after migration to devm_i2c_new_dummy_device.

Why it matters to the business

Local users on systems using the w83792d sensor can trigger kernel crashes, causing denial of service and potential data loss or service interruption on affected hardware monitoring setups.

How an attack unfolds

An attacker with local access reads sensor values from the w83792d device that match the pattern tmp = 0b0xyz1xyz, causing the driver to dereference a now-removed lm75 structure and panic the kernel.

How to fix it

Apply the upstream fix that removes the unused lm75[] array from the w83792d driver; update to a Linux kernel containing commit resolving the NULL dereference.

How to confirm the fix worked

Verify the driver source no longer contains the lm75[] field and test sensor reads with values matching the trigger pattern; confirm absence of oops in dmesg under those conditions.

Typical attack path

1. Obtain local shell or process execution on the target Linux system
2. Interact with the hwmon sysfs interface or directly access the I2C device exposing w83792d registers
3. Supply crafted register values that satisfy the dereference condition
4. Trigger kernel NULL pointer dereference and resulting panic or oops

How to detect it

Search kernel logs and crash dumps for oops or panic messages referencing w83792d and NULL pointer dereference; correlate with processes accessing hwmon or I2C devices.

• w83792d
• NULL pointer dereference
• lm75
• hwmon.*w83792d

What your security team should do

• Patch affected kernels to the fixed version containing the lm75 removal
• Restrict unprivileged local access on systems exposing the w83792d hwmon device
• Monitor kernel logs for w83792d-related NULL dereference oops as a compensating control