LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35974: block: fix q->blkg_list corruption during disk rebind

In the Linux kernel, the following vulnerability has been resolved: block: fix q->blkg_list corruption during disk rebind Multiple gendisk instances can allocated/added for single request queue in case of disk rebind. blkg may still stay in q->blkg_list when calling blkcg_init_disk() for rebind, then q->blkg_list becomes corrupted. Fix the list corruption issue by: - add blkg_init_queue() to initialize q->blkg_list & q->blkcg_mutex only - move calling blkg_init_queue() into blk_alloc_queue() The list corruption should be started since commit f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()") which delays removing blkg from q->blkg_list into blkg_free_workfn().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-35974 is a Linux kernel block-layer flaw that can corrupt an internal list during disk rebind. The public record does not provide a CVSS score, impact rating, or active exploitation evidence, so urgency depends on whether affected kernel versions and disk rebind behavior exist in your estate.

Executive priority

Treat this as a kernel maintenance priority rather than an emergency based on current evidence. Patch affected Linux kernels through normal security update channels, with higher priority for infrastructure that frequently rebinds disks or uses dynamic storage operations.

Technical view

The flaw involves q->blkg_list corruption when multiple gendisk instances are allocated or added for one request queue during disk rebind. A blkcg entry may remain in q->blkg_list when blkcg_init_disk() runs again. Stable fixes initialize q->blkg_list and q->blkcg_mutex in blk_alloc_queue().

Likely exposure

Exposure is most likely on Linux systems running affected kernel versions listed in the CVE record, including 5.18, 6.1.17, 6.2.4, 6.6.28, 6.8.7, and 6.9. Systems without relevant disk rebind paths may have lower practical exposure, but the source does not quantify this.

Exploitation context

The bundle provides no KEV listing, no public exploit confirmation, and no exploitability analysis. The issue appears to be a kernel integrity bug in block-cgroup list management, but the public sources do not state whether it enables privilege escalation, denial of service, or another concrete attacker outcome.

Researcher notes

The root cause is lifecycle ordering around blkcg cleanup: delayed blkg removal can leave stale entries when blkcg_init_disk() is called during rebind. The public bundle names stable commits but does not include CVSS, CWE, exploit status, or a detailed impact statement.

Mitigation direction

  • Identify Linux hosts running affected kernel versions from the CVE record.
  • Apply kernel updates containing the referenced stable fixes from your distribution or kernel vendor.
  • Prioritize systems using dynamic block device attach, detach, or rebind workflows.
  • Check vendor advisories for backported fixes and package-specific fixed versions.

Validation and detection

  • Inventory kernel versions across Linux servers, appliances, and images.
  • Confirm vendor kernel changelogs include the CVE-2024-35974 stable fix.
  • Review systems with block-cgroup usage and disk rebind activity for prioritization.
  • Track remediation through rebooted kernel version, not package installation alone.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-35974 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux81c1188905f88b77743d1fdeeedfc8cb7b67787d, bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a, 1059699f87eb0b3aa9d574b91a572d534897134a, 1059699f87eb0b3aa9d574b91a572d534897134a, 1059699f87eb0b3aa9d574b91a572d534897134aunaffected
LinuxLinux5.18, 0, 6.1.17, 6.2.4, 6.6.28, 6.8.7, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.