CVE-2024-44936

What it actually does

Missing i2c_set_clientdata call after devm_power_supply_register in the rt5033 driver leaves i2c clientdata unset, so subsequent accesses via i2c_get_clientdata dereference invalid or null pointers and trigger kernel oops.

Why it matters to the business

Unexpected kernel crashes on devices using the rt5033 power supply chip cause reboots, loss of power management, and service disruption; low exploitability but high impact on embedded and Android systems running affected kernels.

How an attack unfolds

An attacker with local access loads or removes the rt5033 driver or triggers power-supply events; the missing clientdata pointer is then dereferenced in other driver paths, producing an oops and potential memory corruption.

How to fix it

Upgrade to Linux kernel commit 3c5d0871b0af0184abc6f7f52f8705b39a6251ae or later stable releases; apply the corresponding Android frameworks/base fixes released 2022-12-01 for versions 10, 11, 12, 12L, and 13.

How to confirm the fix worked

Inspect driver source for restored i2c_set_clientdata call; boot affected hardware and exercise power-supply remove paths while monitoring dmesg for absence of rt5033-related oops.

Typical attack path

1. Obtain local code execution or physical access on an rt5033-equipped system
2. Trigger driver probe or remove via sysfs, module load, or power events
3. Invoke code paths that call i2c_get_clientdata without prior set
4. Trigger null/invalid pointer dereference resulting in kernel oops

How to detect it

Search kernel logs and crash dumps for oops or panic strings referencing rt5033, power_supply, or i2c clientdata; correlate with module load/remove timestamps.

What your security team should do

• Prioritize kernel package updates on all affected Linux and Android devices
• Include rt5033 driver paths in crash-log monitoring and triage
• Verify fixed commit presence in custom kernels before deployment