CVE-2024-40933

What it actually does

Incorrect IS_ERR check on wrong pointer (regmap instead of regmap_ee) after devm_regmap_init_i2c failure allows dereference of an ERR_PTR value in mlx90635_probe, resulting in kernel oops or memory corruption.

Why it matters to the business

Potential system crashes or instability on devices using the mlx90635 temperature sensor driver; low prevalence reduces overall operational risk but still requires patching in affected kernels.

How an attack unfolds

An attacker with ability to trigger device probe (local access or malicious hardware) causes the driver to load, hit the faulty error path, and dereference the invalid pointer to induce a crash or attempt further corruption.

How to fix it

Update to a kernel containing commit 5a5595ae8cc7cdaa1a10b56a26ddbe3429245c6c or later; rebuild and deploy the fixed kernel image across affected systems.

How to confirm the fix worked

Confirm kernel source contains the corrected IS_ERR(regmap_ee) check; verify driver loads without oops on probe failure paths using fault injection or modified regmap init.

Typical attack path

1. Gain local access or insert compatible mlx90635 hardware
2. Trigger i2c device registration and mlx90635_probe execution
3. Force devm_regmap_init_i2c failure to enter error path
4. Execute the erroneous IS_ERR check and subsequent dereference

How to detect it

Review kernel logs for oops or panic traces mentioning mlx90635_probe and regmap; inspect dmesg or syslog for i2c regmap initialization failures followed by dereference faults.

What your security team should do

• Prioritize kernel upgrade on systems exposing the mlx90635 driver
• Audit custom kernels or downstream distributions for the copy-paste error
• Monitor for kernel oops reports involving mlx90635_probe