CVE-2024-35880— io_uring/kbuf: hold io_buffer_list reference over mmap
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 9
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 09f7520048eaaee9709091cd2787966f807da7c5< 65938e81df2197203bda4b9a0c477e7987218d66 | affected |
5cf4f52e6d8aa2d3b7728f568abbf9d42a3af252< 5fd8e2359498043e0b5329a05f02d10a9eb91eb9 | affected | ||
5cf4f52e6d8aa2d3b7728f568abbf9d42a3af252< 561e4f9451d65fc2f7eef564e0064373e3019793 | affected | ||
6.6.5< 6.6.26 | affected | ||
6.7 | affected | ||
< 6.7 | unaffected | ||
6.6.26≤ 6.6.* | unaffected | ||
6.8.5≤ 6.8.* | unaffected | ||
| … +1 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-35880
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
io_uring/kbuf: hold io_buffer_list reference over mmap
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: hold io_buffer_list reference over mmap If we look up the kbuf, ensure that it doesn't get unregistered until after we're done with it. Since we're inside mmap, we cannot safely use the io_uring lock. Rely on the fact that we can lookup the buffer list under RCU now and grab a reference to it, preventing it from being unregistered until we're done with it. The lookup returns the io_buffer_list directly with it referenced.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于无法安全地使用 io_uring 锁。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-35880
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-35880
请登录查看更多情报信息。
Other References for CVE-2024-35880 (3)
Same Patch Batch · Linux · 2024-05-19 · 82 CVEs total
| CVE-2024-35861 | 9.8 CRITICAL | smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() |
| CVE-2024-35862 | 9.8 CRITICAL | smb: client: fix potential UAF in smb2_is_network_name_deleted() |
| CVE-2024-35863 | 9.8 CRITICAL | smb: client: fix potential UAF in is_valid_oplock_break() |
| CVE-2024-35864 | 9.8 CRITICAL | smb: client: fix potential UAF in smb2_is_valid_lease_break() |
| CVE-2024-35865 | 9.8 CRITICAL | smb: client: fix potential UAF in smb2_is_valid_oplock_break() |
| CVE-2024-35884 | 9.8 CRITICAL | udp: do not accept non-tunnel GSO skbs landing in a tunnel |
| CVE-2024-35870 | 9.8 CRITICAL | smb: client: fix UAF in smb2_reconnect_server() |
| CVE-2024-35869 | 9.8 CRITICAL | smb: client: guarantee refcounted children from parent session |
| CVE-2024-35939 | 9.3 CRITICAL | dma-direct: Leak pages on dma_set_decrypted() failure |
| CVE-2024-35887 | 8.8 HIGH | ax25: fix use-after-free bugs caused by ax25_ds_del_timer |
| CVE-2024-35915 | 8.8 HIGH | nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet |
| CVE-2024-35889 | 8.6 HIGH | idpf: fix kernel panic on unknown packet types |
| CVE-2024-35875 | 8.4 HIGH | x86/coco: Require seeding RNG with RDRAND on CoCo systems |
| CVE-2024-35937 | 8.1 HIGH | wifi: cfg80211: check A-MSDU format more carefully |
| CVE-2024-35931 | 7.8 HIGH | drm/amdgpu: Skip do PCI error slot reset during RAS recovery |
| CVE-2024-35890 | 7.8 HIGH | gro: fix ownership transfer |
| CVE-2024-35921 | 7.8 HIGH | media: mediatek: vcodec: Fix oops when HEVC init fails |
| CVE-2024-35919 | 7.8 HIGH | media: mediatek: vcodec: adding lock to protect encoder context list |
| CVE-2024-35920 | 7.8 HIGH | media: mediatek: vcodec: adding lock to protect decoder context list |
| CVE-2024-35894 | 7.8 HIGH | mptcp: prevent BPF accessing lowat from a subflow socket. |
Showing top 20 of 82 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
Same vendor: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
V. Comments for CVE-2024-35880
No comments yet