CVE-2024-26717

What it actually does

NULL pointer dereference in the i2c-hid-of driver when a power-up failure occurs because the client pointer is never initialized after the ACPI/OF split.

Why it matters to the business

Kernel crashes or denial of service on Linux systems using I2C HID devices configured via device tree, affecting embedded, ARM, and certain laptop platforms; urgency is low given the age of the issue and minimal observed exploitation.

How an attack unfolds

An attacker with local access or the ability to induce hardware power-up failures on an affected I2C HID device triggers the uninitialized client pointer dereference during driver initialization, resulting in a kernel oops or panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 62f5d219edbd174829aa18d4b3d97cd5fefbb783 or later stable releases that include the fix for the i2c-hid-of client pointer initialization.

How to confirm the fix worked

Verify the presence of commit 62f5d219edbd174829aa18d4b3d97cd5fefbb783 in the kernel source or confirm the running kernel version includes the corrected i2c-hid-of initialization logic; test device power-up failure paths in a lab environment.

Typical attack path

1. Identify a target system using the i2c-hid-of driver for an I2C HID device.
2. Trigger or wait for a power-up failure condition in the device.
3. Cause the driver to dereference the uninitialized client pointer.
4. Induce kernel crash or denial of service.

How to detect it

Review kernel logs for oops or panic messages referencing i2c-hid-of or NULL pointer dereferences during HID device initialization; correlate with system boot or resume events involving I2C HID hardware.

• i2c-hid-of
• NULL pointer dereference
• hid_of_probe

What your security team should do

• Apply the kernel update containing commit 62f5d219edbd174829aa18d4b3d97cd5fefbb783 to all affected systems.
• Prioritize patching on devices that rely on device-tree-configured I2C HID hardware.
• Monitor for related kernel stability issues during routine maintenance.