Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can leave a FireWire OHCI interrupt resource behind when the driver is unbound from a device. The public record shows a resource leak and kernel warning, not remote compromise or active exploitation. Business urgency depends on whether affected Linux kernels and FireWire hardware or drivers exist in your fleet.
Executive priority
Track as a low-priority kernel maintenance item unless your environment relies on FireWire hardware or frequent driver bind/unbind workflows. There is no source-supported evidence of active exploitation, but affected kernels should still receive normal vendor security updates.
Technical view
The regression came from commit 5a95f1ded286, which moved FireWire OHCI IRQ handling to devres but removed explicit free_irq handling. During pci_remove or pci_probe MSI failure handling, pci_disable_msi can encounter a leftover devm_request_irq allocation. Stable fixes add devm_free_irq before MSI teardown.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with the firewire_ohci PCI driver path present, especially where device unbind or MSI failure paths occur. The source bundle does not identify application-level, network, or cloud-service exposure.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not marked KEV. The described impact is an IRQ/proc resource leak during driver unbind or probe failure, with a kernel warning trace. No public source in the bundle claims privilege escalation, data theft, or remote execution.
Researcher notes
Evidence is narrow and kernel-specific. The root cause is cleanup ordering around devm_request_irq and MSI teardown in firewire_ohci. The public bundle provides affected version data and stable commit references, but no CVSS, CWE, exploitability analysis, or broader impact statement.
Mitigation direction
- Update to a vendor kernel containing the referenced stable FireWire OHCI fixes.
- Prioritize distribution advisories for affected Linux kernel branches.
- Confirm change windows for systems with FireWire hardware or firewire_ohci loaded.
- If no package is available, follow vendor guidance before applying kernel patches manually.
Validation and detection
- Inventory Linux hosts for affected kernel versions and FireWire OHCI usage.
- Verify patched kernels include one of the referenced stable commits or distro backports.
- Review kernel logs for remove_proc_entry warnings involving irq and firewire_ohci.
- In staging, confirm driver removal no longer leaves IRQ proc entries.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35816 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/43c70cbc2502cf2557105c662eeed6a15d082b88CVE reference, Linux
- https://git.kernel.org/stable/c/318f6d53dd425c400e35f1a9b7af682c2c6a66d6CVE reference, Linux
- https://git.kernel.org/stable/c/575801663c7dc38f826212b39e3b91a4a8661c33CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.