LiveActive security incident?Get immediate response
CVE Record

CVE-2024-44937: platform/x86: intel-vbtn: Protect ACPI notify handler against recursion

In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-vbtn: Protect ACPI notify handler against recursion Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs") ACPI notify handlers like the intel-vbtn notify_handler() may run on multiple CPU cores racing with themselves. This race gets hit on Dell Venue 7140 tablets when undocking from the keyboard, causing the handler to try and register priv->switches_dev twice, as can be seen from the dev_info() message getting logged twice: [ 83.861800] intel-vbtn INT33D6:00: Registering Intel Virtual Switches input-dev after receiving a switch event [ 83.861858] input: Intel Virtual Switches as /devices/pci0000:00/0000:00:1f.0/PNP0C09:00/INT33D6:00/input/input17 [ 83.861865] intel-vbtn INT33D6:00: Registering Intel Virtual Switches input-dev after receiving a switch event After which things go seriously wrong: [ 83.861872] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:1f.0/PNP0C09:00/INT33D6:00/input/input17' ... [ 83.861967] kobject: kobject_add_internal failed for input17 with -EEXIST, don't try to register things with the same name in the same directory. [ 83.877338] BUG: kernel NULL pointer dereference, address: 0000000000000018 ... Protect intel-vbtn notify_handler() from racing with itself with a mutex to fix this.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel reliability flaw in the Intel virtual button driver. On affected systems, concurrent ACPI notifications can make the driver register the same input device twice, leading to sysfs errors and a kernel NULL pointer dereference. The public report cites Dell Venue 7140 tablet undocking as the observed trigger.

Executive priority

Treat this as a targeted kernel stability issue, not a broad internet-exposed emergency. Patch affected Linux endpoint images during the next maintenance cycle, with faster handling for fleets using Dell Venue 7140-like hardware or docking workflows.

Technical view

The intel-vbtn ACPI notify handler can race with itself after ACPI notify handlers were allowed to run on multiple CPUs. The race can double-register priv->switches_dev, producing duplicate sysfs names and a kernel NULL pointer dereference. The Linux stable fix protects the notify handler with a mutex.

Likely exposure

Exposure appears limited to Linux systems using the platform/x86 intel-vbtn path, especially affected 6.8 through pre-fixed 6.10/6.11 kernels and similar Intel tablet or convertible hardware. The bundle only names Dell Venue 7140 tablets as observed affected hardware.

Exploitation context

No active exploitation is reported in the provided sources, and the CVE is not listed as KEV. The evidence describes a race reached during a hardware state change, not a remotely reachable attack surface. Practical impact is likely local denial of service or crash on affected hardware.

Researcher notes

Evidence is strongest for a concurrency bug in intel-vbtn caused by ACPI notify handler parallelism. Public sources do not provide CVSS, CWE, exploit status, or a broader affected hardware matrix. The fix direction is clearly a mutex around the notify handler.

Mitigation direction

  • Apply Linux or distribution kernel updates containing the referenced stable fixes.
  • Prioritize affected tablet, convertible, and docked fleet systems using intel-vbtn.
  • If no update is available, monitor vendor guidance for supported mitigations.
  • Avoid direct wrangler or deployment relevance; this is host kernel maintenance.

Validation and detection

  • Inventory Linux kernel versions on tablet and convertible endpoints.
  • Check vendor changelogs for the referenced intel-vbtn stable fix commits.
  • Review kernel logs for duplicate intel-vbtn registration or sysfs duplicate filename errors.
  • Confirm whether affected systems load or include the intel-vbtn driver.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-44937 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe2ffcda1629012a2c1a3706432bc45fdc899a584, e2ffcda1629012a2c1a3706432bc45fdc899a584unaffected
LinuxLinux6.8, 0, 6.10.5, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.