CVE-2024-35836

What it actually does

Use-after-free in the dpll subsystem where pin property pointers reference deallocated module memory after a PCI device module rebound, causing a kernel crash on subsequent pin dump operations.

Why it matters to the business

Unexpected system crashes and reboots on Linux servers and devices using dpll hardware, resulting in service outages and potential data loss during recovery.

How an attack unfolds

An attacker with local access or the ability to influence module loading triggers repeated unbind/rebind of a kernel module sharing a PCI device; when the pin dump path is exercised afterward, the stale pointer dereference crashes the kernel.

How to fix it

Upgrade the Linux kernel to version 6.7.3 or later, or apply commit 5050a5b9d8b4d3c6f7e376e07670e437db7ccf9c from the stable repository; ensure all instances of affected modules are rebuilt against the patched kernel.

How to confirm the fix worked

Verify the running kernel version is 6.7.3 or newer; confirm the dpll pin allocation path stores persistent properties rather than module memory references by inspecting source or testing module rebound followed by pin dump.

Typical attack path

1. Obtain local access or module control on a Linux system with dpll support
2. Force or wait for kernel module unbind followed by rebind on the same PCI device
3. Trigger a pin dump operation in the dpll subsystem
4. Kernel dereferences freed memory and crashes

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages containing dpll, pin properties, or module unbind/rebind sequences; correlate with recent module load events.

• dpll pin dump crash
• pin properties pointer to freed module memory
• kernel panic after module rebound

What your security team should do

• Prioritize kernel upgrades on all production Linux systems within the next maintenance window
• Monitor for kernel oops and panic reports mentioning dpll or pin dump
• Test module load/unload cycles in staging environments before deploying to production