CVE-2024-35830

What it actually does

Race condition in tc358743 media driver registers v4l2 async device before successful setup completes, allowing premature userspace access to an incompletely initialized device.

Why it matters to the business

Affected Linux systems risk instability or incorrect media device behavior due to early userspace access; low EPSS with no KEV or ransomware association limits urgency but still requires patching across prevalent kernel deployments.

How an attack unfolds

An attacker triggers device initialization timing to access the v4l2 async device before setup finishes, potentially causing crashes or unexpected behavior; no confirmed exploitation by listed threat actors for this specific issue.

How to fix it

Apply kernel patches ensuring v4l2 registration occurs only after successful setup; for listed packages update answerdev/answer to 72700a7df208db22ec9f9ad5754e584faf48f465 and apache/incubator-answer to e75142a55546e01d8904f59db228422561f51666.

How to confirm the fix worked

Review kernel source or logs to confirm async device registration is gated behind successful tc358743 setup completion; test driver initialization under load.

Typical attack path

1. Locate systems exposing the tc358743 driver
2. Trigger media device registration sequence
3. Race to access v4l2 device from userspace before setup completes
4. Exploit resulting uninitialized state for denial of service or misbehavior

How to detect it

Inspect kernel logs for tc358743 registration events preceding setup completion or v4l2 async device access attempts during early initialization; correlate with userspace media application activity.

What your security team should do

• Prioritize kernel updates for affected media drivers given 880 days since publication
• Monitor EPSS trend stability and re-evaluate if exploitation maturity changes
• Audit custom kernel builds for similar registration ordering issues