LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35836: dpll: fix pin dump crash for rebound module

In the Linux kernel, the following vulnerability has been resolved: dpll: fix pin dump crash for rebound module When a kernel module is unbound but the pin resources were not entirely freed (other kernel module instance of the same PCI device have had kept the reference to that pin), and kernel module is again bound, the pin properties would not be updated (the properties are only assigned when memory for the pin is allocated), prop pointer still points to the kernel module memory of the kernel module which was deallocated on the unbind. If the pin dump is invoked in this state, the result is a kernel crash. Prevent the crash by storing persistent pin properties in dpll subsystem, copy the content from the kernel module when pin is allocated, instead of using memory of the kernel module.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-35836 is a Linux kernel crash bug in the dpll subsystem. Under a specific module unbind/rebind condition, stale pin property data can remain and a later pin dump can crash the kernel. The known impact from the sources is availability loss, not data theft or remote code execution.

Executive priority

Handle through the normal kernel patch cycle, with higher priority for systems where kernel crashes would affect critical services. There is no cited evidence of active exploitation or remote compromise, but unplanned reboot or outage risk justifies remediation.

Technical view

The bug is caused by a dpll pin property pointer referencing memory owned by a kernel module that was deallocated during unbind. If another module instance kept the pin reference and the module is rebound, properties may not refresh. A pin dump can then dereference stale memory and crash. The fix stores persistent pin properties inside the dpll subsystem.

Likely exposure

Exposure appears limited to Linux systems using the affected kernel dpll code path, especially where relevant kernel modules are unbound and rebound while pin references persist. The CVE data indicates affected Linux kernel 6.7-era versions and references stable kernel fixes, but exact downstream distribution exposure must be confirmed with vendor advisories.

Exploitation context

No source in the bundle reports active exploitation, and CISA KEV status is false. The described trigger requires a specific kernel module lifecycle state and a subsequent pin dump. This is best treated as a denial-of-service risk unless additional vendor information states otherwise.

Researcher notes

This is a stale pointer lifetime issue in dpll pin properties after module unbind/rebind. The upstream resolution copies persistent pin properties into dpll-owned storage when the pin is allocated. Source data lacks CVSS, CWE, and detailed downstream version mapping, so confirm against kernel and distribution maintainers.

Mitigation direction

  • Update to a Linux kernel containing the referenced stable dpll fix commits.
  • Check your Linux distribution advisory for backported fixed kernel packages.
  • Prioritize systems that use dpll functionality or perform module unbind/rebind operations.
  • If no vendor package is available, follow vendor guidance for interim risk reduction.

Validation and detection

  • Inventory running Linux kernel versions across affected assets.
  • Compare installed kernels with distribution advisories for CVE-2024-35836.
  • Confirm whether the referenced stable commits are included or backported.
  • Review crash logs for dpll, pin dump, or module rebound related kernel panics.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-35836 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9431063ad323ac864750aeba4d304389bc42ca4e, 9431063ad323ac864750aeba4d304389bc42ca4eunaffected
LinuxLinux6.7, 0, 6.7.3, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.