CVE-2024-26717: HID: i2c-hid-of: fix NULL-deref on failed power up
In the Linux kernel, the following vulnerability has been resolved:
HID: i2c-hid-of: fix NULL-deref on failed power up
A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which is dereferenced on power-up failures.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
HID: i2c-hid-of: fix NULL-deref on failed power up
The Linux kernel CVE team has assigned CVE-2024-26717 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040344-CVE-2024-26717-0d01@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26717?
CVE-2024-26717 has been classified as a high-severity vulnerability due to the potential for a null pointer dereference.
How do I fix CVE-2024-26717?
To resolve CVE-2024-26717, update your Linux kernel to version 5.15.149 or higher, 6.1.79 or higher, or any version specified in the latest security advisories.
Which affected software versions are impacted by CVE-2024-26717?
CVE-2024-26717 affects a range of Linux kernel versions, particularly those before 5.15.149, 6.1.79, and several specified versions in the 6.x series.
What type of vulnerability is CVE-2024-26717?
CVE-2024-26717 is a null pointer dereference vulnerability affecting the i2c-hid component of the Linux kernel.
Is there a workaround for CVE-2024-26717?
Currently, the best mitigation for CVE-2024-26717 is to apply the recommended updates to the Linux kernel, as no workaround has been officially provided.