CVE-2024-42144

What it actually does

Missing NULL check on lvts_data pointer in mediatek lvts_thermal driver allows potential NULL pointer dereference during driver initialization or operation.

Why it matters to the business

Kernel crashes or system instability on affected Linux systems using MediaTek thermal hardware can cause unplanned downtime and require reboots, though widespread exploitation remains unlikely given low EPSS and lack of KEV listing.

How an attack unfolds

An attacker with local access or the ability to influence module loading triggers code paths in lvts_thermal where lvts_data has not been properly initialized, leading to a dereference of a NULL pointer and subsequent kernel fault.

How to fix it

Update the Linux kernel to a version containing commit 79ef1a5593fdb8aa4dbccf6085c48f1739338bc9 in the stable tree; rebuild and deploy the fixed kernel image on all affected systems.

How to confirm the fix worked

Inspect kernel source or running version for presence of the NULL check on lvts_data in drivers/thermal/mediatek/lvts_thermal.c and confirm the commit hash 79ef1a5593fdb8aa4dbccf6085c48f1739338bc9 is included.

Typical attack path

1. Obtain local execution or load the vulnerable mediatek thermal driver
2. Force initialization sequence that leaves lvts_data unpopulated
3. Trigger access to the un-checked pointer resulting in kernel oops or panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or panic messages referencing lvts_thermal or lvts_data NULL dereference around driver probe or thermal zone registration.

What your security team should do

• Apply the referenced kernel commit or later stable release immediately on systems using MediaTek LVTS hardware
• Monitor kernel logs for thermal driver initialization failures until patches are deployed
• Limit local user access on systems where the driver is active until remediation is complete