CVE-2024-35797

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: cachestat: fix two shmem bugs

When cachestat on shmem races with swapping and invalidation, there

are two possible bugs:

1) A swapin error can have resulted in a poisoned swap entry in the

shmem inode's xarray. Calling get_shadow_from_swap_cache() on it

will result in an out-of-bounds access to swapper_spaces[].

Validate the entry with non_swap_entry() before going further.

2) When we find a valid swap entry in the shmem's inode, the shadow

entry in the swapcache might not exist yet: swap IO is still in

progress and we're before __remove_mapping; swapin, invalidation,

or swapoff have removed the shadow from swapcache after we saw the

shmem swap entry.

This will send a NULL to workingset_test_recent(). The latter

purely operates on pointer bits, so it won't crash - node 0, memcg

ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a

bogus test. In theory that could

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References