CVE-2024-35846

What it actually does

NULL pointer dereference in the zswap shrinker when sc->memcg is NULL due to cgroup_disable=memory boot flag, triggered during memcg_page_state() call in non-node zswap accounting.

Why it matters to the business

Kernel crashes on affected Linux systems using zswap with memory cgroups disabled at boot, leading to denial of service, unplanned reboots, and potential data loss or service disruption; high prevalence in container and virtualization environments increases operational risk.

How an attack unfolds

An attacker with local access triggers zswap operations that invoke the shrinker under the memcg-disabled configuration, causing the kernel to dereference a NULL memcg pointer and panic; no remote or unauthenticated paths are known.

How to fix it

Upgrade the Linux kernel to the fixed commit b0fdabc908a7f81d12382c87ca9e46a9c2e14042 or later stable releases containing the zswap shrinker NULL check fix; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm kernel source contains the NULL memcg guard before memcg_page_state() in the zswap shrinker; test boot with cgroup_disable=memory and induce memory pressure to verify no crash occurs.

Typical attack path

1. Boot system with cgroup_disable=memory flag
2. Enable zswap and perform memory pressure operations that activate the shrinker
3. Trigger code path reaching memcg_page_state() with NULL memcg
4. Kernel dereferences NULL and panics

How to detect it

Search kernel logs for oops or panic messages referencing zswap_shrinker, memcg_page_state, or NULL dereference during shrinker activity; correlate with systems booted using cgroup_disable=memory.

• zswap_shrinker
• memcg_page_state
• NULL dereference in zswap

What your security team should do

• Prioritize kernel upgrade on all systems using zswap with cgroup memory disabled
• Audit boot parameters for cgroup_disable=memory usage
• Monitor for zswap-related kernel oops and panics until patched
• Consider disabling zswap temporarily if immediate patching is not feasible