CVE-2024-35991

What it actually does

The vulnerability is a locking mismatch in the Linux kernel idxd DMA engine driver where a spinlock protects the event log workqueue, preventing safe use of drain_workqueue() which may reschedule tasks and trigger __queue_work invalid operation exceptions in multi-task scenarios.

Why it matters to the business

Linux systems relying on the idxd driver for hardware DMA operations may experience kernel warnings or instability during concurrent event log processing, reducing reliability of data movement workloads in servers and embedded devices.

How an attack unfolds

An attacker with the ability to trigger DMA operations and concurrent workloads on an affected Linux kernel can induce the race by scheduling work on the event log workqueue while drain_workqueue runs under the spinlock, causing the documented call trace and potential denial of service.

How to fix it

Update the Linux kernel to a version containing commit 758071a35d9f3ffd84ff12169d081412a2f5f098 which converts the spinlock to a mutex, allowing safe drain_workqueue calls.

How to confirm the fix worked

Verify the running kernel includes the mutex conversion commit, then exercise idxd event log paths under load while monitoring for absence of the __queue_work invalid_op trace.

Typical attack path

1. Obtain local execution or trigger DMA engine activity on an idxd-equipped system
2. Generate concurrent access to the event log workqueue
3. Force drain_workqueue while the spinlock is held
4. Trigger queue_work_on from within the atomic context
5. Observe kernel call trace and potential system instability

How to detect it

Search kernel logs and dmesg for the call trace containing __queue_work, idxd_misc_thread, and asm_exc_invalid_op; correlate with idxd module activity under load.

What your security team should do

• Prioritize kernel upgrades on systems exposing idxd hardware
• Apply the mutex conversion patch if backporting is required
• Monitor kernel logs for idxd-related call traces until patched
• Test DMA workloads after update to confirm stability