CVE-2024-35945

What it actually does

Null pointer dereference in PHY device ISR when phydev->irq is set without a valid interrupt handler, leading to exceptions instead of safe fallback to polling.

Why it matters to the business

Kernel panics or system instability on Linux-based network equipment, causing downtime for servers, embedded devices, and Android systems; high ecosystem prevalence increases urgency for patching.

How an attack unfolds

An attacker configures a PHY device to unconditionally enable irq without registering a handler, then triggers an interrupt to execute the ISR and dereference a null pointer. Threat actors associated with Android Kernel Remote Code Execution Vulnerability may leverage this in kernel-level attacks on affected devices.

How to fix it

Update the Linux kernel to the fixed commit 7a71f61ebf95cedd3f245db6da397822971d8db5 or equivalent stable releases containing the fix; rebuild and deploy updated kernels across affected systems.

How to confirm the fix worked

Verify the presence of the fix by inspecting phy_device.c for conditional irq handler checks or test ISR paths with invalid handlers to confirm fallback to polling without crashes.

Typical attack path

1. Identify systems running vulnerable Linux kernel versions
2. Gain local or hardware-adjacent access to manipulate PHY device configuration
3. Set phydev->irq without a valid handler
4. Trigger interrupt to invoke ISR
5. Trigger null pointer exception for denial of service or potential escalation

How to detect it

Search kernel logs for oops or panic messages referencing phy_device ISR or null pointer dereferences in interrupt context; correlate with PHY device initialization events.

What your security team should do

• Prioritize kernel updates on all production Linux systems within 30 days
• Audit PHY driver configurations for unconditional irq assignments
• Enable kernel panic logging and monitoring for PHY-related null dereferences
• Test updates in staging environments before broad deployment