CVE-2024-35904

What it actually does

Failure of kern_mount() returns an ERR_PTR that is subsequently dereferenced instead of being handled in the error path, and a never-read static variable is also removed.

Why it matters to the business

Kernel panic or undefined behavior during SELinux filesystem mount operations can cause system instability or denial of service on affected Linux distributions.

How an attack unfolds

An attacker triggers a kern_mount failure condition for the SELinux filesystem; the error pointer is then dereferenced, leading to a crash. The listed Android kernel RCE threat actor context does not apply to this specific flaw.

How to fix it

Update the Linux kernel to commit 477ed6789eb9f3f4d3568bb977f90c863c12724e or later stable releases containing the fix.

How to confirm the fix worked

Verify the presence of commit 477ed6789eb9f3f4d3568bb977f90c863c12724e in the kernel source tree and confirm that mount error paths correctly return without dereferencing ERR_PTR values.

Typical attack path

1. Identify a context where SELinux mount can be forced to fail
2. Cause kern_mount to return ERR_PTR
3. Trigger continuation past the error check to dereference the pointer

How to detect it

Review kernel logs for SELinux mount failures followed by oops or panic traces containing selinuxfs references; no specific post-exploitation artifacts are known.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all systems
• Prioritize patching servers and Android-based devices given the kernel scope
• Monitor for any post-patch stability issues during SELinux-enabled mounts