5.5

CVE-2024-35984: i2c: smbus: fix NULL function pointer dereference

Modified
AliasesUBUNTU-CVE-2024-35984DEBIAN-CVE-2024-35984
Published 20-05-2024Last modified 15-10-2026

Vulnerability summary

CVE-2024-35984 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.4% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.26%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 37 · Related 33
DLA-3840-1DLA-3842-1MGASA-2024-0263MGASA-2024-0266SUSE-SU-2024:1979-1SUSE-SU-2024:1983-1

Timeline

  1. 20-05-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: fix NULL function pointer dereference Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function always being available. Fix this by always checking the pointer in __i2c_transfer. [wsa: dropped the simplification in core-smbus to avoid theoretical regressions]

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.26%

Chance of exploitation in the next 30 days

Percentile

17%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.26% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu128 products
  • linux< 4.4.0-257.291 | < 4.15.0-227.239 | < 5.4.0-189.209 | < 5.15.0-116.126 | < 6.8.0-39.39
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 4.4.0-1134.140 | < 4.4.0-1172.187 | < 4.15.0-1170.183 | < 5.4.0-1128.138 | < 5.15.0-1065.71 | < 6.8.0-1012.13
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 63453b59e41173241c4efe9335815f6432fa8586, < 40f1d79f07b49c8a64a861706e5163f2db4bd95d | ≥ 63453b59e41173241c4efe9335815f6432fa8586, < ad3c3ac7a03be3697114f781193dd3e9d97e6e23 | ≥ 63453b59e41173241c4efe9335815f6432fa8586, < 5fd72404587d7db4acb2d241fd8c387afb0a7aec | ≥ 63453b59e41173241c4efe9335815f6432fa8586, < 5a09eae9a7db597fe0c1fc91636205b4a25d2620 | ≥ 63453b59e41173241c4efe9335815f6432fa8586, < 4e75e222d397c6752b229ed72fc4644c8c36ecde | ≥ 63453b59e41173241c4efe9335815f6432fa8586, < e3425674ff68dc521c57c6eabad0cbd20a027d85 | ≥ 63453b59e41173241c4efe9335815f6432fa8586, < 357c64ef1ef39b1e7cd91ab6bdd304d043702c83 | ≥ 63453b59e41173241c4efe9335815f6432fa8586, < 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f | 4.19
  • linux_kernel≥ 3.19, < 4.19.313 | ≥ 4.20, < 5.4.275 | ≥ 5.5, < 5.10.216 | ≥ 5.11, < 5.15.158 | ≥ 5.16, < 6.1.90 | ≥ 6.2, < 6.6.30 | ≥ 6.7, < 6.8.9
Debian1 product
  • linux< 6.1.90-1 | < 6.8.9-1

3 vendors · 131 products

References

38 links
Show all 38 references