Loading story…
CVE-2024-26717 is a local denial-of-service flaw in the Linux kernel's Open Firmware (OF) I2C HID driver at drivers/hid/i2c-hid/i2c-hid-of.c. Introduced in kernel 5.12 when I2C HID support was split into ACPI and OF implementations, the OF driver can leave a client pointer uninitialized; a failed device power-up can then trigger a NULL-pointer dereference and crash or restart the kernel.
The issue is fixed in upstream kernels 5.15.149, 6.1.79, 6.6.18, 6.7.6, and 6.8 and later. Red Hat rated the flaw CVSS 4.4 (low) and released corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.4 Extended Update Support systems; its referenced advisory listed RHEL 9 kernel-rt as affected without a corresponding erratum. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual patch.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:7000 and RHSA-2024:7001, fixing affected RHEL 8 kernel and kernel-rt packages for CVE-2024-26717.
Red Hat issued RHSA-2025:10701 to fix the RHEL 9.4 Extended Update Support kernel package for CVE-2024-26717.
Red Hat issued RHSA-2024:9315 to fix the affected RHEL 9 kernel package for CVE-2024-26717.
The issue was fixed in Linux kernel versions 5.15.149, 6.1.79, 6.6.18, 6.7.6, and 6.8. The Linux kernel CVE team recommended upgrading to a current stable release rather than cherry-picking individual patches.
The Linux kernel CVE team assigned CVE-2024-26717 to the NULL-pointer dereference in drivers/hid/i2c-hid/i2c-hid-of.c.
A change that split the I2C HID implementation into ACPI and OF drivers left the OF driver's client pointer uninitialized, creating a NULL-pointer dereference path after failed power-up operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47386** is a NULL-pointer dereference in the Linux kernel's `w83791d` hardware-monitoring driver. Device-provided values can trigger a read path that dereferences an obsolete `lm75[]` structure field, causing a kernel crash and resulting in a local denial of service. The field was no longer needed after the driver moved subclient detection to `devm_i2c_new_dummy_device()`. The issue was identified by the Linux Driver Verification project and fixed in kernel versions 5.4.151, 5.10.71, 5.14.10, and 5.15 and later. Red Hat rates the flaw Moderate (CVSS 4.4), requiring local high privileges with availability-only impact; fixes are available in affected RHEL 8 and RHEL 9 kernel packages, while RHEL 9 `kernel-rt` is marked will not fix and RHEL 6 and 7 are outside support scope.
Aug 26, 2026
**CVE-2021-47385** is a Linux kernel flaw in the `w83792d` hardware-monitoring driver. Under a specific device-read value pattern, the driver can dereference a NULL pointer through an obsolete `lm75[]` structure field, causing a kernel crash or system instability and creating a local denial-of-service condition. The issue was fixed by removing the unnecessary field from `drivers/hwmon/w83792d.c` and is addressed in kernel versions 5.4.151, 5.10.71, 5.14.10, and 5.15 or later stable releases. Red Hat rated the issue moderate severity (CVSS 4.4), noting local high-privilege access is required, while NVD assigned CVSS 5.5; affected organizations should update kernel packages, including supported RHEL 8 and 9 streams, as no practical mitigation is available.
Aug 26, 2026
**CVE-2021-47289** is a moderate-severity Linux kernel flaw in ACPI device reference handling. A code path introduced by commit `71f642833284` could invoke `acpi_dev_put()` with a NULL pointer, leading the helper to call `put_device()` using an invalid offset and potentially crash the host. Red Hat assigned a CVSS v3.1 score of 5.5, reflecting low-complexity local exploitation with high availability impact. Upstream fixed the issue by making `acpi_dev_put()` safely handle NULL pointers; fixes are included in kernel versions 5.4.139, 5.10.57, 5.13.6, and 5.14 and later stable releases. Red Hat remediated affected RHEL 8 kernel and kernel-rt packages through RHSA-2024:7000 and RHSA-2024:7001, while RHEL 6 and 7 are outside support scope and should be treated as vulnerable unless otherwise mitigated.
Aug 26, 2026