CVE-2024-35797

What it actually does

In Linux kernel cachestat on shmem, races with swapping and invalidation allow poisoned swap entries to trigger out-of-bounds access to swapper_spaces[] or NULL passed to workingset_test_recent(), classified as MemoryCorruption.

Why it matters to the business

Linux systems using shmem with swap may experience crashes or inaccurate memory eviction accounting; low exploit likelihood but kernel stability risk in affected versions.

How an attack unfolds

An attacker triggers swapin errors or concurrent invalidation/swapoff on shmem while invoking cachestat to reach the unvalidated swap entry path or NULL shadow case, potentially leading to OOB read.

How to fix it

Update the Linux kernel to commit b79f9e1ff27c994a4c452235ba09e672ec698e23 or a later stable release containing the fix for both shmem cachestat bugs.

How to confirm the fix worked

Verify kernel source includes the referenced commit or test cachestat behavior under swap/invalidation races on shmem; confirm no OOB or NULL handling issues remain.

Typical attack path

1. Create or access shmem-backed file
2. Force swap activity and swapin errors via memory pressure
3. Race cachestat syscall against swap/invalidation operations
4. Trigger poisoned entry or missing shadow to reach vulnerable paths

How to detect it

Search kernel logs for oops or warnings referencing get_shadow_from_swap_cache, swapper_spaces, or workingset_test_recent during cachestat calls on shmem.

What your security team should do

• Apply kernel update containing b79f9e1ff27c994a4c452235ba09e672ec698e23 immediately on affected systems
• Monitor for kernel oops/panics involving swapper_spaces or cachestat
• Review shmem and swap usage in production workloads for exposure