CVE-2024-35929

What it actually does

Race condition in RCU nocb bypass locking causes WARN_ON_ONCE assertions in rcu_nocb_bypass_lock and rcu_nocb_wait_contended when CONFIG_RCU_NOCB_CPU_DEFAULT_ALL and CONFIG_RCU_LAZY are enabled, triggered during lazy RCU shrink scans that contend on the same rdp from different CPUs.

Why it matters to the business

Kernel warnings and potential instability on systems using lazy RCU and nocb defaults, increasing operational noise and risk of unexpected behavior during memory reclamation; low exploitability reduces immediate risk but requires patching for long-term stability.

How an attack unfolds

An attacker with local access triggers the condition by performing operations that invoke lazy_rcu_shrink_scan (such as dropping caches), causing contention on nocb_bypass_lock from a different CPU than the rdp owner, leading to the warning path; no remote or unauthenticated exploitation path exists.

How to fix it

Update to a kernel containing commit 4d58c9fb45c70e62c19e8be3f3605889c47601bc or later; rebuild with the fixed rcu_nocb_try_flush_bypass call in lazy_rcu_shrink_scan; reboot after installation.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; attempt reproduction via 'echo 3 > /proc/sys/vm/drop_caches' and verify absence of the WARN_ON_ONCE messages in dmesg; check kernel config for the two relevant RCU options.

Typical attack path

1. Obtain local shell or process execution on affected kernel
2. Trigger memory pressure or explicit drop_caches to invoke shrink_slab and lazy_rcu_shrink_scan
3. Cause concurrent rcu_nocb_flush_bypass from another CPU while holding contended lock state
4. Hit WARN_ON_ONCE checks on CPU affinity and contention counters

How to detect it

Search kernel logs for rcu_nocb_bypass_lock or rcu_nocb_wait_contended WARN_ON_ONCE entries; correlate with drop_caches or shrink_slab activity; no persistent artifacts remain after reboot.

What your security team should do

• Prioritize upgrade on systems with both CONFIG_RCU_NOCB_CPU_DEFAULT_ALL and CONFIG_RCU_LAZY enabled
• Monitor dmesg for the specific WARN_ON_ONCE strings after applying the fix
• Include the patch in standard kernel update cycles even without KEV listing due to stability impact