CVE-2024-36925

What it actually does

NULL pointer dereference during list_add_rcu when initializing restricted DMA pools under CONFIG_DMA_RESTRICTED_POOL=y combined with CONFIG_SWIOTLB_DYNAMIC=y, caused by uninitialized mem->pools list_head in rmem_swiotlb_device_init.

Why it matters to the business

Boot-time kernel panic on systems using restricted DMA pools with dynamic SWIOTLB, resulting in system unavailability and requiring configuration changes or kernel updates to restore operation.

How an attack unfolds

An attacker with the ability to control boot configuration or hardware setup enabling both restricted DMA pools and dynamic SWIOTLB triggers the uninitialized list_head during device initialization at early boot, causing a kernel NULL dereference and panic; no remote code execution or privilege escalation path exists.

How to fix it

Update the Linux kernel to a version containing commit f2a6b3ed20f2dea4cb645abc6a73c4595662adca or later; rebuild with the corrected swiotlb initialization of mem->pools list_head before add_mem_pool calls.

How to confirm the fix worked

Verify the presence of the fix commit in the running kernel source; confirm that restricted DMA pool initialization no longer triggers the list validation fault at the cited call sites in kernel/dma/swiotlb.c.

Typical attack path

1. Enable CONFIG_DMA_RESTRICTED_POOL and CONFIG_SWIOTLB_DYNAMIC in kernel config
2. Configure reserved memory regions for DMA at device tree or platform level
3. Boot the system triggering of_reserved_mem_device_init_by_idx
4. rmem_swiotlb_device_init attempts list_add_rcu to uninitialized mem->pools
5. Kernel panics with NULL pointer dereference

How to detect it

Examine kernel boot logs for the Oops signature referencing rmem_swiotlb_device_init and list validation failures in include/linux/list.h; search dmesg or journalctl for the exact panic string involving NULL pointer at virtual address 0000000000000008.

What your security team should do

• Prioritize kernel upgrade on any system using restricted DMA pools with dynamic SWIOTLB
• Audit kernel configurations for simultaneous enablement of CONFIG_DMA_RESTRICTED_POOL and CONFIG_SWIOTLB_DYNAMIC
• Test boot stability after applying the fix in lab environments before production rollout
• Monitor for related upstream stable branch updates