CVE-2024-35880

What it actually does

Use-after-free in io_uring/kbuf during mmap: kbuf lookup could return a buffer list that gets unregistered before mmap completes, as the io_uring lock cannot be held inside mmap; fixed by performing RCU-protected lookup and acquiring a reference on io_buffer_list.

Why it matters to the business

Potential kernel instability, crashes, or limited privilege escalation on Linux systems that use io_uring workloads; low urgency given absence from KEV, low EPSS, and publication more than two years ago with stable fixes available.

How an attack unfolds

An attacker triggers a concurrent unregister of an io_uring buffer list while another thread performs an mmap on the same kbuf, relying on the race window before the reference was held; no named threat actors or ransomware campaigns are associated with active exploitation.

How to fix it

Upgrade Linux kernel to a fixed release such as 6.6.26 or apply commit 65938e81df2197203bda4b9a0c477e7987218d66 in stable trees; rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel version is at or above the fixed release; inspect io_uring mmap paths in source for the RCU lookup plus reference acquisition pattern.

Typical attack path

1. Obtain io_uring instance and register a buffer list
2. Trigger mmap on the registered buffer while concurrently unregistering the list
3. Exploit the freed io_buffer_list object during mmap processing

How to detect it

Review kernel crash logs and oops reports involving io_uring buffer lists or mmap paths; search audit or system logs for unusual io_uring registration/unregistration sequences around the time of any stability incidents.

What your security team should do

• Identify all systems running vulnerable kernels and schedule upgrades to 6.6.26 or later
• Prioritize patching on hosts that heavily use io_uring for high-throughput I/O
• Monitor vendor advisories for backports into older LTS branches still in use