CVE-2024-35831

What it actually does

Failure in __io_uaddr_map error path after page pinning causes pinned pages to be leaked instead of released when returning -EINVAL.

Why it matters to the business

Long-running systems under memory pressure may exhaust pinned page resources, leading to degraded io_uring performance or eventual denial of service; kernel updates required across fleets.

How an attack unfolds

An attacker triggers io_uring operations that invoke __io_uaddr_map under conditions of high memory fragmentation, causing the pinning step to succeed but a later step to fail, leaving pages pinned without release and potentially enabling further memory manipulation.

How to fix it

Update Linux kernel to commit ffc253263a1375a65fa6c9f62a893e9767fbebfa or later; rebuild and deploy updated kernel packages; verify with kernel version checks post-reboot.

How to confirm the fix worked

Confirm kernel source contains the fix commit; run regression tests exercising io_uring address mapping error paths; monitor for pinned page accounting stability under load.

Typical attack path

1. Identify or create workload that exercises io_uring with user addresses
2. Force or wait for memory fragmentation sufficient to cause post-pin failure
3. Trigger __io_uaddr_map path that returns -EINVAL without releasing pages
4. Repeat to accumulate leaked pinned pages and degrade system resources

How to detect it

Search kernel logs and audit trails for repeated io_uring failures around address mapping; monitor pinned page counters via /proc or eBPF for unexpected growth; examine crash dumps for page reference leaks in io_uring paths.

What your security team should do

• Prioritize kernel upgrades on systems using io_uring in production
• Apply updates before the next scheduled maintenance window given widespread kernel exposure
• Review io_uring usage in container and host environments for exposure
• Enable memory accounting and OOM monitoring as temporary compensating control