CVE-2024-26717: HID: i2c-hid-of: fix NULL-deref on failed power up
In the Linux kernel, the following vulnerability has been resolved:
HID: i2c-hid-of: fix NULL-deref on failed power up
A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which is dereferenced on power-up failures.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
HID: i2c-hid-of: fix NULL-deref on failed power up
The Linux kernel CVE team has assigned CVE-2024-26717 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040344-CVE-2024-26717-0d01@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.149 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.79 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.18 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26717?
CVE-2024-26717 has been classified as a high-severity vulnerability due to the potential for a null pointer dereference.
How do I fix CVE-2024-26717?
To resolve CVE-2024-26717, update your Linux kernel to version 5.15.149 or higher, 6.1.79 or higher, or any version specified in the latest security advisories.
Which affected software versions are impacted by CVE-2024-26717?
CVE-2024-26717 affects a range of Linux kernel versions, particularly those before 5.15.149, 6.1.79, and several specified versions in the 6.x series.
What type of vulnerability is CVE-2024-26717?
CVE-2024-26717 is a null pointer dereference vulnerability affecting the i2c-hid component of the Linux kernel.
Is there a workaround for CVE-2024-26717?
Currently, the best mitigation for CVE-2024-26717 is to apply the recommended updates to the Linux kernel, as no workaround has been officially provided.