Security readout for executives and security teams
Plain-English summary
CVE-2024-27412 is a Linux kernel bug in the bq27xxx I2C battery driver. On systems where the battery device has no IRQ, removing or unbinding the driver can incorrectly free IRQ 0, causing a kernel warning and backtrace. The main business risk is local availability impact on affected Linux-based devices.
Executive priority
Treat as a targeted availability maintenance item, not an emergency. Prioritize patching Linux-based devices that use bq27xxx battery hardware, especially managed embedded fleets where local service disruption could affect operations.
Technical view
The bq27xxx_battery_i2c_probe path only requests an IRQ when client->irq is present, but the remove path unconditionally calls free_irq(client->irq). If client->irq is 0, the kernel attempts to free a non-existing or already-free IRQ. The upstream fix mirrors probe logic by checking client->irq before free_irq.
Likely exposure
Exposure is most likely on Linux systems using the bq27xxx I2C power-supply driver, especially embedded, mobile, IoT, or hardware platforms with TI bq27xxx battery fuel-gauge devices and no configured IRQ. General servers without this hardware or driver are less likely exposed.
Exploitation context
The CVSS vector is local, low complexity, and requires low privileges. The bundle reports no CISA KEV listing, and no cited source states active exploitation. Evidence supports a local availability issue during driver removal or unbind, not remote compromise.
Researcher notes
The source evidence is specific: request_threaded_irq is conditional in probe, while free_irq was unconditional in remove. The available sources do not establish remote reachability, data exposure, privilege escalation, weaponized exploitation, or a broad enterprise-server impact.
Mitigation direction
- Update to a vendor kernel containing the listed stable kernel fixes.
- Apply Debian LTS kernel updates where Debian advisories apply.
- Check kernel vendor guidance for exact fixed package versions.
- Avoid unnecessary bq27xxx-i2c driver unbinds on affected hardware until patched.
- Prioritize embedded and fleet devices using bq27xxx battery gauges.
Validation and detection
- Inventory systems loading the bq27xxx-i2c or bq27xxx battery driver.
- Confirm whether the affected device lacks a configured IRQ.
- Compare running kernel versions against vendor-fixed kernel releases.
- Review kernel logs for IRQ 0 free warnings during driver removal.
- Validate patched kernels include the client->irq guard in remove logic.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit d4d813c0
- Linux stable commit 7394abc8
- Linux stable commit d7acc4a5
- Linux stable commit e601ae81
- Linux stable commit cefe18e9
- Linux stable commit fbca8bae
- Linux stable commit 08368647
- Linux stable commit 2df70149
- Debian LTS advisory DLA June 2024
- Debian LTS advisory DLA June 2024
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27412 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d4d813c0a14d6bf52d810a55db06a2e7e3d98eaaCVE reference, Linux
- https://git.kernel.org/stable/c/7394abc8926adee6a817bab10797e0adc898af77CVE reference, Linux
- https://git.kernel.org/stable/c/d7acc4a569f5f4513120c85ea2b9f04909b7490fCVE reference, Linux
- https://git.kernel.org/stable/c/e601ae81910ce6a3797876e190a2d8ef6cf828bcCVE reference, Linux
- https://git.kernel.org/stable/c/cefe18e9ec84f8fe3e198ccebb815cc996eb9797CVE reference, Linux
- https://git.kernel.org/stable/c/fbca8bae1ba79d443a58781b45e92a73a24ac8f8CVE reference, Linux
- https://git.kernel.org/stable/c/083686474e7c97b0f8b66df37fcb64e432e8b771CVE reference, Linux
- https://git.kernel.org/stable/c/2df70149e73e79783bcbc7db4fa51ecef0e2022cCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.