CVE-2024-35874

What it actually does

Race condition in aio_complete() allows list_del_init_careful() to not be the final access to a wait-queue entry, enabling the completion path to perform a wakeup after the task_struct pointer has been overwritten and resulting in a null-pointer dereference.

Why it matters to the business

Unprivileged local users can trigger kernel crashes, leading to denial-of-service on Linux systems that use asynchronous I/O; the bug affects a broad range of kernel versions and requires prompt patching to restore stability.

How an attack unfolds

An attacker issues concurrent asynchronous I/O operations that race the completion and wakeup paths; the window created by the incorrect ordering lets finish_wait() observe an empty list, skip the lock, and allow the subsequent wakeup to dereference a now-invalid task_struct pointer.

How to fix it

Upgrade the Linux kernel to version 6.8.5 or later, or apply the commit 9678bcc6234d83759fe091c197f5017a32b468da (or its backports) in the stable tree. Reboot after installing the updated kernel package.

How to confirm the fix worked

Confirm the running kernel reports a version string containing 6.8.5 or newer, or verify the presence of the listed commit in the kernel source tree; test that aio stress workloads no longer produce null-pointer oops in dmesg.

Typical attack path

1. Open an aio context and submit multiple I/O requests from multiple threads or processes.
2. Force a timing window that interleaves aio_complete() with finish_wait() on the same wait-queue entry.
3. Trigger the list_del_init_careful() ordering bug so that the wakeup occurs after the task_struct pointer is overwritten.
4. Cause the null-pointer dereference and resulting kernel panic or oops.

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing aio_complete, wait_queue, or null pointer dereference in the aio path; correlate with processes performing heavy asynchronous I/O immediately before the crash.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-tenant Linux hosts within the next maintenance window.
• Monitor vendor advisories for backported fixes in distribution kernels older than 6.8.5.
• Add kernel crash-dump collection and alerting for aio-related oops until patches are deployed.