CVE-2024-35809

What it actually does

Race condition between runtime_idle callback and driver remove callback in PCI PM allows concurrent execution after pm_runtime_get_sync, resulting in unhandled page fault and kernel crash in drivers providing runtime_idle handlers.

Why it matters to the business

Kernel crashes on affected Linux systems using certain PCI hardware drivers cause unplanned downtime, potential data corruption, and require reboots; widespread kernel deployments increase operational risk.

How an attack unfolds

An attacker with local access or ability to trigger PCI device removal and runtime PM events can race the runtime_idle callback against removal logic, leading to page fault crash; no named threat actors or ransomware usage reported for this issue.

How to fix it

Update Linux kernel to commit 9a87375bb586515c0af63d5dcdcd58ec4acf20a6 or later stable versions that include the pm_runtime_barrier call in pci_device_remove.

How to confirm the fix worked

Verify kernel source contains the barrier call after pm_runtime_get_sync in pci_device_remove; test runtime PM and driver removal sequences on affected hardware for absence of crashes.

Typical attack path

1. Obtain local access or trigger conditions for PCI device management
2. Initiate driver removal sequence while runtime PM events are active
3. Exploit incomplete synchronization after pm_runtime_get_sync to allow runtime_idle to continue
4. Trigger page fault in rtsx_pcr or similar driver leading to kernel panic

How to detect it

Search kernel logs and crash dumps for page faults or panics referencing rtsx_pcr_runtime_idle, pci_device_remove, or runtime PM callbacks during driver unload; correlate with device removal events.

• rtsx_pcr_runtime_idle
• unhandled page fault in pci_device_remove
• RPM_ACTIVE status during runtime_idle

What your security team should do

• Apply kernel update containing the fix as highest priority for systems with PCI devices using runtime PM
• Monitor for kernel oops or panic reports involving runtime PM and PCI drivers
• Review custom or downstream kernel builds for inclusion of the barrier synchronization