LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35929: rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()

In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock() For the kernels built with CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y and CONFIG_RCU_LAZY=y, the following scenarios will trigger WARN_ON_ONCE() in the rcu_nocb_bypass_lock() and rcu_nocb_wait_contended() functions: CPU2 CPU11 kthread rcu_nocb_cb_kthread ksys_write rcu_do_batch vfs_write rcu_torture_timer_cb proc_sys_write __kmem_cache_free proc_sys_call_handler kmemleak_free drop_caches_sysctl_handler delete_object_full drop_slab __delete_object shrink_slab put_object lazy_rcu_shrink_scan call_rcu rcu_nocb_flush_bypass __call_rcu_commn rcu_nocb_bypass_lock raw_spin_trylock(&rdp->nocb_bypass_lock) fail atomic_inc(&rdp->nocb_lock_contended); rcu_nocb_wait_contended WARN_ON_ONCE(smp_processor_id() != rdp->cpu); WARN_ON_ONCE(atomic_read(&rdp->nocb_lock_contended)) | |_ _ _ _ _ _ _ _ _ _same rdp and rdp->cpu != 11_ _ _ _ _ _ _ _ _ __| Reproduce this bug with "echo 3 > /proc/sys/vm/drop_caches". This commit therefore uses rcu_nocb_try_flush_bypass() instead of rcu_nocb_flush_bypass() in lazy_rcu_shrink_scan(). If the nocb_bypass queue is being flushed, then rcu_nocb_try_flush_bypass will return directly.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel RCU bug that can trigger one-time kernel warnings under specific RCU build configurations. The public record describes a reliability issue, not data theft or remote compromise. Business urgency depends on whether affected kernels use CONFIG_RCU_NOCB_CPU_DEFAULT_ALL and CONFIG_RCU_LAZY.

Executive priority

Handle through normal kernel patch governance unless critical systems use the affected RCU configuration or show matching warnings. There is no KEV listing or cited exploitation evidence, so this should not outrank actively exploited vulnerabilities.

Technical view

The flaw is in RCU nocb bypass locking. When lazy RCU shrink activity races with a nocb callback thread, WARN_ON_ONCE checks in rcu_nocb_bypass_lock() or rcu_nocb_wait_contended() can fire. The stable fix changes lazy_rcu_shrink_scan() to use rcu_nocb_try_flush_bypass().

Likely exposure

Likely limited to Linux systems running affected kernel builds with both named RCU configuration options. The bundle lists Linux kernel version entries including 6.5, 6.6.27, 6.8.6, and 6.9, but distro backport status and exact deployed exposure are not provided.

Exploitation context

The bundle marks KEV as false, and no cited source states active exploitation. The description gives a local reproducibility condition involving drop-caches behavior, suggesting operational or local-trigger reliability impact rather than confirmed remote exploitation. No exploit availability evidence is included.

Researcher notes

Evidence is narrow: CVE text and kernel stable references identify the race, configuration dependency, warning sites, and fix strategy, but provide no CVSS, CWE, impact class, or distro mapping. Treat exposure and exploitability conclusions as provisional until vendor advisories are reviewed.

Mitigation direction

  • Apply vendor kernel packages that include the upstream stable fix.
  • Check distribution vendor advisories for backported remediation status.
  • Prioritize systems using both named RCU configuration options.
  • Monitor affected systems for kernel warning recurrence after updates.

Validation and detection

  • Inventory Linux kernel versions and vendor patch levels.
  • Verify whether both RCU configuration options are enabled.
  • Review kernel logs for matching WARN_ON_ONCE signatures.
  • Map installed kernels to vendor advisories or stable commit inclusion.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-35929 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7625926086765123251f765d91fc3a70617d334d, 7625926086765123251f765d91fc3a70617d334d, 7625926086765123251f765d91fc3a70617d334dunaffected
LinuxLinux6.5, 0, 6.6.27, 6.8.6, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.