PT-2024-8421 · Linux+6 · Linux Kernel+6

Syzbot

·

Published

2024-04-03

·

Updated

2025-09-29

·

CVE-2024-35892

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.74-syzkaller
Description The issue is related to a lockdep splat in the qdisc tree reduce backlog() function, which is called with the qdisc lock held, not RTNL. This can lead to suspicious RCU usage. The qdisc lookup() function should be replaced with qdisc lookup rcu() to fix the issue. The vulnerability can cause a denial of service.
Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the qdisc tree reduce backlog() function. As a temporary workaround, consider disabling the qdisc tree reduce backlog() function until a patch is available.

Exploit

Fix

Improper Locking

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-667

Related Identifiers

ALSA-2025_12746
ALSA-2025_12752
ALSA-2025_12753
ALSA-2025_16880
BDU:2024-09980
CVE-2024-35892
INFSA-2024_9315
RHSA-2024:9315
RHSA-2024_9315
SUSE-SU-2024:2571-1
SUSE-SU-2024:2896-1
SUSE-SU-2024:2973-1
SUSE-SU-2025:20008-1
SUSE-SU-2025:20028-1
USN-6893-1
USN-6893-2
USN-6893-3
USN-6918-1

Affected Products

Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu