CVE-2024-35879

What it actually does

Race condition between asynchronous devlink removal workqueue jobs (triggered by of_platform_depopulate) and of_changeset_destroy / __of_changeset_entry_destroy during of_overlay_remove, causing of_node refcounts to be released too late and triggering refcount warnings or memory leaks.

Why it matters to the business

Kernel warnings and potential memory leaks on systems performing dynamic device-tree overlay removal after platform device depopulation; affects stability of embedded Linux devices and any workloads relying on live OF changeset management.

How an attack unfolds

An attacker or automated process triggers the sequence of_platform_depopulate followed immediately by of_overlay_remove; the devlink cleanup runs asynchronously, allowing of_changeset_destroy to run before the final of_node_put, resulting in the documented refcount warning.

How to fix it

Update the Linux kernel to commit 62fb9874f5da54fdb243003b386128037319b219 or later; rebuild and deploy the fixed kernel image on all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 62fb9874f5da54fdb243003b386128037319b219; reproduce the of_platform_depopulate + of_overlay_remove sequence and confirm absence of the refcount warning.

Typical attack path

1. Call of_platform_depopulate to destroy devices and queue devlink removal work
2. Immediately invoke of_overlay_remove to destroy OF nodes via of_changeset_destroy
3. Workqueue job releases the device and of_node after the changeset has already run
4. Kernel logs refcount mismatch warning and leaks the of_node reference

How to detect it

Search kernel logs for the exact error message 'ERROR: memory leak, expected refcount 1 instead of 2' and any related of_node_put warnings around overlay or platform device removal events.

• ERROR: memory leak, expected refcount 1 instead of 2
• of_changeset_destroy
• __of_changeset_entry_destroy

What your security team should do

• Prioritize kernel upgrade on any system using dynamic device-tree overlays
• Add monitoring for the kernel error string 'expected refcount 1 instead of 2'
• Test overlay removal paths in staging environments before production rollout