CVE-2024-49871

What it actually does

Null pointer dereference occurs in adp5589-keys driver when devm action calls adp5589_clear_config() before i2c_set_clientdata() has executed, returning NULL from i2c_get_clientdata() during early probe failure.

Why it matters to the business

Device initialization failures on affected Linux systems can trigger kernel crashes or instability, increasing downtime risk for systems relying on the ADP5589 input hardware; low EPSS and no KEV status indicate limited immediate widespread operational disruption.

How an attack unfolds

An attacker triggers an early failure path in the input driver probe (for example via resource allocation error) before client data registration completes; the registered devm cleanup handler then dereferences the unset pointer. Listed threat actors in 2024 zero-day and Linux kernel campaigns could incorporate similar resource-handling flaws for denial-of-service effects.

How to fix it

Apply the upstream fix that moves i2c_set_clientdata() earlier or adjusts devm action registration order; update to a kernel version containing the resolution for CVE-2024-49871. No specific package versions listed for remediation.

How to confirm the fix worked

Confirm i2c_set_clientdata() occurs prior to devm action registration in the probe function; test probe failure paths and verify no NULL dereference occurs; monitor kernel logs for adp5589 related oops messages.

Typical attack path

1. Gain local access or trigger hardware probe conditions on target system
2. Force early exit in adp5589-keys probe before i2c_set_clientdata()
3. Dev-managed cleanup action executes and calls i2c_get_clientdata() returning NULL
4. NULL dereference causes kernel panic or oops

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log) for adp5589-keys NULL pointer dereference or oops entries around probe time; correlate with I2C device initialization failures. Threat actor mentions of Linux kernel resource issues may share similar log patterns.

• adp5589_clear_config
• i2c_get_clientdata
• NULL pointer dereference.*adp5589

What your security team should do

• Prioritize kernel updates on systems using ADP5589 or similar I2C input devices
• Review probe error handling in custom input drivers for similar ordering issues
• Monitor EPSS trend (stable at ~0.0024) and kernel vulnerability disclosures for related flaws