CVE-2024-26717

HID: i2c-hid-of: fix NULL-deref on failed power up

MEDIUM

5.5

CVSS Score

Published: April 3, 2024 at 02:55 PM UTC

Updated: June 17, 2026 at 07:18 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid-of: fix NULL-deref on failed power up A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which is dereferenced on power-up failures.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.12 ≤ v < 5.15.1495.12 ≤ v < 6.1.795.12 ≤ v < 6.6.185.12 ≤ v < 6.7.65.12 ≤ v < 6.85.16 ≤ v < 6.1.796.2 ≤ v < 6.6.186.7 ≤ v < 6.7.66.8 rc1 6.8 rc2b33752c300232d7f95dd9a4353947d0c9e6a0e52

Vendor states this is fixed in 00aab7dcb2267f2aef59447602f34501efe1a07f (fixed)

Vendor states this is fixed in 4cad91344a62536a2949873bad6365fbb6232776 (fixed)

Vendor states this is fixed in 62f5d219edbd174829aa18d4b3d97cd5fefbb783 (fixed)

Vendor states this is fixed in d7d7a0e3b6f5adc45f23667cbb919e99093a5b5c (fixed)

Vendor states this is fixed in e28d6b63aeecbda450935fb58db0e682ea8212d3 (fixed)

Vendor states this is fixed in 5.12 (unaffected)

Vendor states this is fixed in 5.15.149 (unaffected)

Vendor states this is fixed in 6.1.79 (unaffected)

Vendor states this is fixed in 6.6.18 (unaffected)

Vendor states this is fixed in 6.7.6 (unaffected)

Vendor states this is fixed in 6.8 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references