CVE-2024-27412

What it actually does

The bq27xxx-i2c driver unconditionally invokes free_irq on client->irq (value 0 when no IRQ is present) during device removal, triggering a kernel warning for freeing an already-free IRQ despite a matching guard existing in the probe path.

Why it matters to the business

Systems using affected Linux kernels may encounter stability warnings or unexpected behavior during driver unload or device hot-unplug on embedded hardware with bq27xxx battery monitors, increasing operational overhead for kernel maintenance in large fleets.

How an attack unfolds

An attacker with local access could attempt to trigger repeated driver binding and unbinding sequences to generate kernel warnings and potential resource accounting issues, though the flaw primarily manifests as a defensive coding error rather than a direct code-execution vector; listed threat actors associated with broader kernel ownership and use-after-free issues provide context for similar patterns.

How to fix it

Update the Linux kernel to a version containing commit 6995e2de6891c724bfeb2db33d7b87775f913ad1 or later; rebuild and deploy the updated kernel image across affected systems.

How to confirm the fix worked

Confirm the presence of the if (client->irq) guard around free_irq in bq27xxx_battery_i2c_remove after applying the fix, then perform driver bind/unbind cycles while monitoring for absence of the 'Trying to free already-free IRQ 0' warning.

Typical attack path

1. Identify a system exposing the bq27xxx-i2c driver
2. Obtain local privileges sufficient to manage the device or module
3. Trigger driver removal or unbind operation
4. Observe resulting kernel warning and backtrace in logs

How to detect it

Search kernel logs for the exact warning string 'Trying to free already-free IRQ 0' combined with backtraces referencing bq27xxx_battery_i2c_remove; correlate with device removal or module unload events in dmesg or journalctl.

What your security team should do

• Prioritize kernel updates for any production systems using bq27xxx battery monitoring hardware
• Review device trees and driver configurations to ensure IRQ assignment is consistently handled
• Incorporate kernel warning log monitoring into existing SIEM rules for early detection of similar driver issues