CVE-2024-35826

What it actually does

Incorrect page reference counting in __bio_release_pages() when handling buffers that do not start at a page boundary, resulting in under- or over-release of pages and potential memory management corruption.

Why it matters to the business

System instability or crashes during storage and block I/O operations on Linux kernels, potentially disrupting workloads, data processing, and server availability in affected environments.

How an attack unfolds

A local attacker with low privileges crafts or triggers block I/O operations using unaligned buffers to invoke the flawed release path, causing refcount mismatches that may lead to use-after-free conditions or kernel panics.

How to fix it

Upgrade the Linux kernel to a version containing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be or later; apply the fix from the mainline git repository and rebuild or deploy updated kernel packages.

How to confirm the fix worked

Verify the running kernel contains commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be; test block I/O paths with unaligned buffers and confirm no refcount-related warnings or panics occur in dmesg.

Typical attack path

1. Gain local user or process access on a Linux system
2. Trigger block or storage I/O with buffers not aligned to page boundaries
3. Invoke __bio_release_pages() through normal or malformed I/O paths
4. Exploit resulting refcount error for memory corruption or denial of service

How to detect it

Review kernel logs for oops or warnings mentioning __bio_release_pages, bio page refcounts, or unaligned buffer handling; search system audit logs for unusual block I/O patterns preceding crashes.

• __bio_release_pages
• page refcount mismatch
• unaligned buffer bio

What your security team should do

• Prioritize kernel updates to the fixed commit across all Linux distributions and deployments
• Monitor for related memory corruption issues in storage subsystems
• Restrict unprivileged local access where feasible until patches are applied