CVE-2024-35985

What it actually does

Integer overflow in s64 vlag scaling multiplication inside reweight_eevdf() allows vruntime to become invalid, causing entity_eligible() to return false for every runnable entity and pick_eevdf() to return NULL, resulting in a NULL dereference.

Why it matters to the business

Kernel panic or crash on Linux systems performing scheduler reweight operations, producing unplanned downtime and potential loss of in-memory state across servers, containers, and embedded devices.

How an attack unfolds

An attacker or workload triggers repeated task reweighting under conditions that cause the unprotected vlag computation to overflow; the resulting bogus vruntime makes every entity appear ineligible, pick_eevdf returns NULL, and the scheduler dereferences the pointer.

How to fix it

Upgrade the Linux kernel to version 6.6.30 or later, or apply commit 470d347b14b0ecffa9b39cf8f644fa2351db3efb in the stable tree; rebuild and reboot all affected systems.

How to confirm the fix worked

Verify running kernel version is at least 6.6.30; inspect scheduler source for the vlag range limit added to reweight_eevdf(); test under synthetic reweight workloads that previously triggered the overflow.

Typical attack path

1. Cause reweight_eevdf() to be invoked on a sched entity
2. Perform weight change that forces 20-bit fixed-point scaling multiplication to overflow s64
3. Produce vruntime value that makes entity_eligible() return false for all tasks
4. Force pick_eevdf() to return NULL
5. Trigger NULL pointer dereference in scheduler path

How to detect it

Search kernel logs and crash dumps for oops/panic messages referencing pick_eevdf, reweight_eevdf, or entity_eligible; correlate with task reweight events preceding the crash.

• pick_eevdf
• reweight_eevdf
• entity_eligible

What your security team should do

• Prioritize kernel upgrades on all production Linux hosts within the next maintenance window
• Include the fixed commit in any custom or downstream kernel builds
• Monitor kernel crash logs for scheduler NULL dereference signatures until patches are deployed