CVE-2024-35926

What it actually does

Memory leak of idxd descriptors in iaa_compress and iaa_decompress async_disable paths when request destination is null, occurring only in specific test scenarios.

Why it matters to the business

Gradual resource exhaustion in Linux kernel crypto acceleration code during targeted testing workloads, with negligible operational effect on production systems due to extremely low exploit probability and no known active campaigns.

How an attack unfolds

An attacker would need to trigger the exact async_disable test paths with null destination buffers to induce descriptor leaks; no remote unauthenticated path exists and no threat actors have been observed exploiting this.

How to fix it

Upgrade Linux kernel to version 6.8.6 or later, or apply commit d994f7d77aaded05dc05af58a2720fd4f4b72a83 from the stable git repository.

How to confirm the fix worked

Confirm kernel version is at least 6.8.6; inspect iaa driver source for the added free of descriptors in async_disable paths; run iaa crypto test cases with null destination and monitor for descriptor leaks.

Typical attack path

1. Identify a system running an affected Linux kernel version before 6.8.6
2. Trigger iaa crypto test paths that set request destination to null
3. Repeat to accumulate unfreed descriptors

How to detect it

Review kernel logs and test harness output for repeated iaa descriptor allocation without corresponding frees in async paths; no public indicators of real-world exploitation exist.

What your security team should do

• Prioritize kernel upgrade to 6.8.6 on systems using iaa crypto acceleration
• Monitor EPSS and KEV status for any future changes despite current low scores
• Include iaa driver paths in kernel fuzzing and test coverage