CVE-2024-35974

What it actually does

List corruption in q->blkg_list when multiple gendisk instances are allocated for a single request queue during disk rebind, caused by delayed blkg removal from the list.

Why it matters to the business

Linux systems may experience kernel instability, crashes, or unpredictable behavior during disk rebind operations, potentially affecting storage reliability in servers and embedded devices.

How an attack unfolds

An attacker triggers conditions that cause repeated disk rebind operations on a request queue, allowing stale blkg entries to remain in q->blkg_list and corrupt the list structure, which can be leveraged for further memory manipulation.

How to fix it

Update the Linux kernel to the fixed commit b5dae1cd0d8368b4338430ff93403df67f0b8bcc or later stable releases containing the blkg_init_queue changes.

How to confirm the fix worked

Verify the presence of blkg_init_queue initialization in blk_alloc_queue and confirm absence of list corruption after rebind operations in patched kernels.

Typical attack path

1. Identify or create conditions for disk rebind on target Linux system
2. Trigger multiple gendisk allocations for the same request queue
3. Exploit resulting list corruption for denial of service or memory corruption primitives

How to detect it

Review kernel logs for list corruption warnings or oops during disk rebind; inspect for unusual block layer activity around the time of the introduced commit f1c006f1c685.

What your security team should do

• Apply the kernel fix immediately on all affected systems
• Monitor for disk rebind events in production workloads
• Test storage subsystems for stability post-upgrade