CVE-2024-35984

What it actually does

A NULL function pointer dereference in the Linux kernel I2C SMBus subsystem causes a kernel OOPS/panic when the designware controller is used in target-only mode, as the code path assumes a transfer function pointer is always present.

Why it matters to the business

Linux systems using affected kernels with designware I2C hardware in target-only configurations can experience sudden crashes and downtime; the issue has low exploitation likelihood and no known ransomware usage or CISA deadline.

How an attack unfolds

A local attacker enables target-only mode on a designware I2C controller and performs an SMBus transfer; the missing pointer check in __i2c_transfer triggers the dereference and kernel crash. No named threat actors are associated with this flaw.

How to fix it

Upgrade the Linux kernel to a version containing commit 40f1d79f07b49c8a64a861706e5163f2db4bd95d or later in the stable tree.

How to confirm the fix worked

Confirm the fix is present by inspecting the __i2c_transfer function for an explicit pointer check before dereference; test the designware controller in target-only mode to ensure no OOPS occurs.

Typical attack path

1. Obtain local access to a Linux system
2. Configure the designware I2C controller into target-only mode
3. Initiate an I2C/SMBus transfer operation
4. Trigger NULL pointer dereference resulting in kernel OOPS

How to detect it

Search kernel logs and dmesg output for OOPS messages referencing i2c_smbus or NULL function pointer dereference during transfers on designware controllers.

What your security team should do

• Apply the kernel update containing the referenced commit on all systems using designware I2C controllers
• Review kernel logs for i2c-related NULL pointer OOPS events
• Limit local user access on systems where target-only I2C mode may be enabled