CVE-2021-47386

What it actually does

NULL pointer dereference in the w83791d hwmon driver when a sensor value satisfies (val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7)), caused by an obsolete lm75[] array after the switch to devm_i2c_new_dummy_device.

Why it matters to the business

Affected Linux systems with w83791d hardware monitoring may crash or allow local privilege escalation; low urgency given stable low EPSS, no KEV listing, and limited ecosystem exposure outside specific embedded or monitoring deployments.

How an attack unfolds

A local attacker reads or influences the w83791d sensor register to produce the triggering bit pattern (tmp = 0b0xyz1xyz), causing the driver to dereference the now-removed lm75 structure and trigger memory corruption.

How to fix it

Upgrade to kernels or packages containing the upstream fix that removes lm75[]. For the listed products apply cluster-autoscaler-fips-1.32 (Chainguard): fixed in 1.32.0-r1 and cluster-autoscaler-fips-1.32-compat (Chainguard): fixed in 1.32.0-r1.

How to confirm the fix worked

Confirm the lm75[] field and associated dereference logic are absent from the w83791d driver source; exercise the sensor read path with the known triggering value pattern and verify no NULL dereference occurs.

Typical attack path

1. Obtain local user access on a system exposing the w83791d driver
2. Access the device via sysfs or direct I2C reads to supply the crafted sensor value
3. Trigger the bit-pattern condition that dereferences the stale pointer
4. Escalate via the resulting kernel memory corruption

How to detect it

Inspect kernel ring buffer and dmesg for oops/panic entries referencing w83791d or lm75; correlate with processes accessing /sys/class/hwmon or I2C device nodes around the time of the fault.

What your security team should do

• Apply the fixed package versions immediately on systems containing the w83791d driver
• Restrict local unprivileged access to hardware monitoring sysfs interfaces
• Monitor kernel logs for w83791d-related oops or NULL pointer faults