CVE-2024-44937 is a vulnerability in the Linux kernel affecting the ACPI (Advanced Configuration and Power Interface) notify handler for the intel-vbtn driver, which manages Intel Virtual Button events. The root cause is a race condition introduced by a kernel commit (e2ffcda16290) that allowed ACPI notify handlers to run concurrently on multiple CPU cores. This concurrency leads to the intel-vbtn notify_handler() racing against itself, particularly evident on Dell Venue 7140 tablets during keyboard undocking events. The race condition causes the handler to attempt registering the same input device (priv->switches_dev) multiple times, resulting in duplicate device registration attempts. This triggers kernel log messages indicating duplicate registration and ultimately leads to a kernel NULL pointer dereference and system instability or crash. The fix involves protecting the notify_handler() with a mutex to serialize access and prevent concurrent execution, thereby eliminating the race condition. This vulnerability is specific to the intel-vbtn ACPI driver and the Linux kernel versions containing the problematic commit. No known exploits are reported in the wild as of the publication date, and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2024-44937 primarily concerns systems running vulnerable Linux kernels on hardware platforms using the intel-vbtn driver, notably certain Dell Venue tablets or similar devices. The vulnerability can cause kernel crashes (denial of service) due to NULL pointer dereferences triggered by race conditions in ACPI event handling. This can lead to system instability, unexpected reboots, or downtime, which may disrupt business operations, especially in environments relying on affected hardware for critical tasks. While this vulnerability does not directly lead to privilege escalation or data compromise, the denial of service can affect availability, potentially impacting service continuity. Organizations with Linux-based endpoint devices, embedded systems, or specialized hardware using affected drivers should be aware. The lack of known exploits reduces immediate risk, but the vulnerability could be targeted in the future, especially in environments where physical undocking events or similar triggers are common. Additionally, kernel crashes can complicate forensic investigations and may be leveraged as part of multi-stage attacks.

1. Apply the official Linux kernel patch that introduces a mutex to protect the intel-vbtn notify_handler(), preventing concurrent execution and race conditions. Monitor Linux kernel repositories and vendor advisories for updated kernel versions containing this fix. 2. For organizations unable to immediately patch, consider temporarily disabling the intel-vbtn driver if it is not critical to operations, to avoid triggering the race condition. 3. Implement robust monitoring of kernel logs for duplicate registration messages or related ACPI errors that could indicate attempts to exploit this vulnerability. 4. Test kernel updates in controlled environments before deployment to ensure compatibility and stability, especially on affected hardware models like Dell Venue tablets. 5. Maintain an inventory of hardware models and Linux kernel versions in use to identify potentially vulnerable systems. 6. Educate IT and security teams about this vulnerability to recognize symptoms of kernel instability related to ACPI events. 7. Coordinate with hardware vendors for firmware updates or guidance if applicable, as ACPI interactions involve both hardware and software layers.