CVE-2024-35997

What it actually does

Race condition in i2c-hid driver allows I2C_HID_READ_PENDING flag to remain set during interrupt handling, causing the RT interrupt handler to spin in an infinite loop and starve the scheduler.

Why it matters to the business

Linux systems using I2C HID devices can become completely unresponsive, forcing manual reboots and interrupting operations; high ecosystem prevalence of the kernel increases exposure across servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access performs I2C HID transfers while arranging for an interrupt to occur exactly when the flag is set; the resulting RT-task loop consumes the CPU and prevents any other task, including flag-clearing code, from running.

How to fix it

Upgrade the Linux kernel to a version containing commit 21bfca822cfc1e71796124e93b46e0d9fa584401 or later; rebuild and reboot all affected systems; apply vendor-supplied kernel packages as soon as they become available.

How to confirm the fix worked

Confirm the running kernel contains commit 21bfca822cfc1e71796124e93b46e0d9fa584401 via uname or kernel build logs; attempt to reproduce the original flag-handling path in a test environment and verify absence of the infinite-loop condition.

Typical attack path

1. Obtain local user or process execution on the target system
2. Trigger I2C HID read or transfer operations via userspace input devices or crafted HID traffic
3. Time or induce an interrupt while I2C_HID_READ_PENDING is asserted
4. Interrupt handler enters infinite retry loop, locking up the system

How to detect it

Review system logs for repeated i2c-hid interrupt activity or scheduler starvation messages immediately preceding an unexplained hang; correlate with dmesg entries mentioning I2C_HID_READ_PENDING around the time of the outage.

What your security team should do

• Prioritize kernel updates on all systems exposing I2C HID devices within the next patching cycle
• Monitor vendor advisories for backported fixes in supported LTS kernels
• Restrict untrusted local access until patches are deployed