The Linux kernel's intel-hid ACPI notify handler was vulnerable to race conditions because notify handlers could run concurrently on multiple CPU cores. On certain devices identified by chassis types 31 and 32, the SW_TABLET_MODE input device was registered lazily during the first tablet-mode event. Concurrent events on different CPUs could bypass the check for existing input devices, leading to duplicate registrations, duplicate sysfs entries, and a NULL pointer dereference. This vulnerability is similar to a previously fixed issue in the intel-vbtn driver. The fix involves adding a mutex to serialize access to the notify handler and prevent recursion and race conditions.

The vulnerability could cause a NULL pointer dereference in the kernel, potentially leading to a system crash (kernel panic) or denial of service on affected convertible and detachable devices. There is no indication of privilege escalation or arbitrary code execution from the provided data.

A fix has been implemented in the Linux kernel by protecting the intel-hid notify handler with a mutex to prevent concurrent execution and recursion. Users should update to the Linux kernel version that includes this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.