CVE-2024-27412: power: supply: bq27xxx-i2c: Do not free non existing IRQ
In the Linux kernel, the following vulnerability has been resolved:
power: supply: bq27xxx-i2c: Do not free non existing IRQ
The bq27xxx i2c-client may not have an IRQ, in which case client->irq will be 0. bq27xxxbatteryi2cprobe() already has an if (client->irq) check wrapping the requestthreadedirq().
But bq27xxxbatteryi2cremove() unconditionally calls freeirq(client->irq) leading to:
[ 190.310742] ------------[ cut here ]------------ [ 190.310843] Trying to free already-free IRQ 0 [ 190.310861] WARNING: CPU: 2 PID: 1304 at kernel/irq/manage.c:1893 freeirq+0x1b8/0x310
Followed by a backtrace when unbinding the driver. Add an if (client->irq) to bq27xxxbatteryi2cremove() mirroring probe() to fix this.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27412?
CVE-2024-27412 is classified as a low severity vulnerability in the Linux kernel.
How do I fix CVE-2024-27412?
To fix CVE-2024-27412, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What component is affected by CVE-2024-27412?
CVE-2024-27412 affects the bq27xxx-i2c driver in the Linux kernel.
What is the impact of CVE-2024-27412?
The impact of CVE-2024-27412 includes potential improper handling of IRQs when the bq27xxx i2c-client does not exist.
Is CVE-2024-27412 exploitable remotely?
CVE-2024-27412 is not considered to be exploitable remotely as it pertains to local device handling within the kernel.