CVE-2024-35793

What it actually does

Incorrect refcount handling in debugfs removal prevents cancellation triggers when files are accessed concurrently, allowing deadlocks instead of graceful completion or cancellation.

Why it matters to the business

Kernel deadlocks during debugfs operations can cause system instability, hangs, or crashes in Linux environments that rely on dynamic filesystem debugging interfaces, increasing operational risk for servers and embedded devices.

How an attack unfolds

An attacker with local access triggers concurrent debugfs file operations and removal attempts; the flawed logic skips cancellation paths, leading to indefinite waits and deadlock when refcounts do not reach zero as expected.

How to fix it

Apply the upstream fix by updating the Linux kernel to commit e88b5ae01901c4a655a53158397746334778a57b or later stable versions containing this change.

How to confirm the fix worked

Verify the presence of commit e88b5ae01901c4a655a53158397746334778a57b in the kernel source tree or confirm the running kernel was built after the fix; test concurrent debugfs access and removal for absence of deadlock.

Typical attack path

1. Obtain local access to a Linux system using debugfs
2. Identify or create debugfs entries under active use
3. Perform concurrent file access while triggering removal operations
4. Exploit missed cancellation logic to induce deadlock

How to detect it

Review kernel logs for deadlock warnings or hung tasks involving debugfs; inspect for processes stuck in remove operations without corresponding cancellation events.

What your security team should do

• Prioritize kernel updates to the fixed commit on all affected systems
• Monitor for kernel oops or hang reports involving debugfs
• Restrict debugfs access via mount options where possible until patched