CVE-2024-35816

What it actually does

Failure to call devm_free_irq() before pci_disable_msi() in the firewire_ohci driver leaves an IRQ descriptor allocated, causing remove_proc_entry warnings and leakage of IRQ resources on driver unbind or probe failure paths.

Why it matters to the business

Systems using FireWire hardware may experience repeated kernel warnings, minor resource leakage, and potential stability issues during device driver load/unload cycles; low urgency given narrow hardware scope and absence from known exploitation lists.

How an attack unfolds

An attacker with local access triggers repeated bind/unbind operations on the firewire_ohci PCI device (for example via module reload or hotplug), exhausting IRQ descriptors over time and producing observable kernel log noise; no remote vector or privilege escalation path exists.

How to fix it

Update the Linux kernel to a version containing commit 43c70cbc2502cf2557105c662eeed6a15d082b88 or later; ensure devm_free_irq() is invoked before pci_disable_msi() in both pci_remove() and the fail_msi error path of pci_probe().

How to confirm the fix worked

Confirm the running kernel contains commit 43c70cbc2502cf2557105c662eeed6a15d082b88; verify absence of remove_proc_entry warnings referencing 'irq' and 'firewire_ohci' during driver unbind; inspect dmesg after module reload.

Typical attack path

1. Obtain local shell or module-loading privileges on a system with the firewire_ohci driver loaded
2. Trigger pci_remove() by unbinding the driver or removing the FireWire controller
3. Observe leftover IRQ descriptor during pci_disable_msi() and subsequent remove_proc_entry failure
4. Repeat to accumulate leaks and warnings

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for remove_proc_entry warnings that reference irq directories and the string firewire_ohci; inspect call traces containing pci_remove, pci_disable_msi, and unregister_irq_proc around the time of driver unbind events.

What your security team should do

• Apply the referenced kernel commit or distribution update containing the fix
• Audit systems for presence of firewire_ohci and disable the module if FireWire hardware is not required
• Monitor kernel logs for remove_proc_entry warnings mentioning firewire_ohci as a temporary detection measure