CVE-2024-44937

What it actually does

Race condition in intel-vbtn ACPI notify handler allows concurrent execution across CPUs after ACPI OSL changes, resulting in duplicate input device registration, sysfs conflicts, and NULL pointer dereference.

Why it matters to the business

Specific Dell Venue tablets experience kernel crashes or instability during undocking; low EPSS and no KEV status limit broad risk but require targeted kernel updates for affected hardware.

How an attack unfolds

Physical access to undock a Dell Venue 7140 tablet triggers the ACPI notify event; concurrent handler runs create duplicate device entries leading to kernel panic.

How to fix it

Apply Linux kernel patch 5c9618a3b6ea94cf7bdff7702aca8bf2d777d97b; update affected Android frameworks/base to December 2022 releases for 10/11/12/12L/13.

How to confirm the fix worked

Verify kernel contains the mutex protection around notify_handler; confirm single registration message on undock and absence of duplicate sysfs or dereference errors.

Typical attack path

1. Obtain physical access to affected Dell tablet
2. Undock from keyboard to generate switch event
3. Trigger race in notify_handler causing duplicate registration
4. Induce sysfs conflict and kernel NULL dereference

How to detect it

Search kernel logs for repeated 'Registering Intel Virtual Switches input-dev' messages, sysfs duplicate filename errors, or NULL pointer dereferences involving intel-vbtn or input17.

• Registering Intel Virtual Switches input-dev after receiving a switch event
• sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:1f.0/PNP0C09:00/INT33D6:00/input/input17'
• kobject: kobject_add_internal failed for input17 with -EEXIST
• BUG: kernel NULL pointer dereference, address: 0000000000000018

What your security team should do

• Prioritize kernel upgrade on Dell Venue 7140 systems
• Test undocking behavior post-update
• Monitor kernel logs for intel-vbtn registration messages