Security readout for executives and security teams
Plain-English summary
A Linux kernel RAID1 write-path flaw can free an I/O object while it is still in use when a RAID member is blocked. This can corrupt kernel memory or crash affected systems. Exploitation requires local, low-privileged access and the specific RAID1 condition; it is not remotely exploitable according to the supplied CVSS vector.
Executive priority
Treat as a high-priority infrastructure patch for affected RAID1 systems, especially multi-user hosts and platforms running untrusted workloads. It is less urgent for systems without software RAID1 or without local exposure. Schedule remediation through normal emergency kernel maintenance rather than treating it as an internet-wide active exploitation event.
Technical view
In raid1_write_request(), r1_bio->bios[] temporarily references the original bio. Encountering a blocked RAID device calls free_r1bio(), which can release that original bio prematurely, causing a use-after-free. The cited fix frees the not-yet-issued r1_bio directly with mempool_free(). CVSS 3.1 is 7.8: local, low complexity, low privileges, no user interaction, with potentially high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to Linux systems running an affected kernel and using software RAID1 where a member can enter the blocked state during writes. The bundle lists 6.6, 6.6.28, 6.8.7, and 6.9 as affected, but downstream distributions may backport fixes without changing their base version.
Exploitation context
The supplied CVSS vector requires local access and low privileges. The source demonstrates a kernel memory-safety failure under concurrent RAID1 writes and a blocked member. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation, public weaponization, or remote reachability.
Researcher notes
The documented failure depends on r1_bio->bios[] holding the original bio before lower-device bios exist, followed by a blocked rdev path invoking free_r1bio(). The supplied trace confirms premature freeing; it does not establish reliable privilege escalation. Researchers should distinguish demonstrated memory corruption and availability impact from the broader theoretical CVSS confidentiality and integrity impacts.
Mitigation direction
- Apply a vendor-supported kernel containing the cited RAID1 fix or its documented backport.
- Prioritize RAID1 hosts where local untrusted users or workloads can perform storage writes.
- If patching is delayed, follow distribution guidance for safe temporary RAID1 risk reduction.
- Reboot into the corrected kernel where required, then confirm the active kernel version.
Validation and detection
- Inventory active kernel versions and identify hosts using Linux software RAID1.
- Check distribution advisories or package changelogs for a CVE-2024-35979 backport.
- Confirm the running kernel, not merely the installed package, contains the fix.
- Review kernel logs for RAID1 faults, bio errors, use-after-free reports, or unexplained crashes.
- Avoid reproducing the fault on production storage; use controlled, disposable test systems if necessary.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35979 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3f28d49a328fe20926995d5fbdc92da665596268CVE reference, Linux
- https://git.kernel.org/stable/c/f423f41b7679c09abb26d2bd54be5cbef23c9446CVE reference, Linux
- https://git.kernel.org/stable/c/fcf3f7e2fc8a53a6140beee46ec782a4c88e4744CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.