CVE-2024-35916

What it actually does

A memory allocation failure in mock_chain() causes it to return NULL, which is then passed to dma_fence_enable_sw_signaling() triggering a NULL pointer dereference in the Linux kernel dma-buf subsystem.

Why it matters to the business

Systems running affected Linux kernels may experience unexpected crashes or denial of service during dma-buf operations under low-memory conditions, potentially disrupting services and requiring restarts.

How an attack unfolds

An attacker with local access could attempt to trigger the vulnerable code path by inducing memory pressure during mock_chain() allocation, leading to the NULL dereference and kernel panic; the issue was identified through static analysis rather than active campaigns.

How to fix it

Update the Linux kernel to the fixed commit 0336995512cdab0c65e99e4cdd47c4606debe14e or later stable versions containing this change; apply the patch that guards the call to dma_fence_enable_sw_signaling() behind a successful mock_chain() return.

How to confirm the fix worked

Verify the running kernel contains commit 0336995512cdab0c65e99e4cdd47c4606debe14e; recompile with the fix and confirm no NULL dereference occurs under simulated allocation failure in mock_chain().

Typical attack path

1. Gain local code execution on a Linux system using dma-buf
2. Force memory allocation failure in mock_chain()
3. Invoke dma_fence_enable_sw_signaling() with the resulting NULL pointer
4. Trigger kernel NULL dereference and potential crash

How to detect it

Inspect kernel logs for oops or panic entries mentioning dma_fence_enable_sw_signaling or mock_chain under memory pressure; correlate with processes exercising dma-buf allocation paths.

• dma_fence_enable_sw_signaling
• mock_chain
• NULL pointer dereference in sanitycheck

What your security team should do

• Prioritize kernel updates on all affected Linux systems within standard patching windows given the low EPSS and lack of KEV listing
• Monitor for kernel oops or panic logs referencing dma_fence_enable_sw_signaling
• Review dma-buf usage in custom drivers or test frameworks for similar unchecked allocation patterns