GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-35797 (GCVE-0-2024-35797)

Vulnerability from cvelistv5 – Published: 2024-05-17 13:23 – Updated: 2026-08-05 11:30
VLAI
Title
mm: cachestat: fix two shmem bugs
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1) A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling get_shadow_from_swap_cache() on it will result in an out-of-bounds access to swapper_spaces[]. Validate the entry with non_swap_entry() before going further. 2) When we find a valid swap entry in the shmem's inode, the shadow entry in the swapcache might not exist yet: swap IO is still in progress and we're before __remove_mapping; swapin, invalidation, or swapoff have removed the shadow from swapcache after we saw the shmem swap entry. This will send a NULL to workingset_test_recent(). The latter purely operates on pointer bits, so it won't crash - node 0, memcg ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a bogus test. In theory that could result in a false "recently evicted" count. Such a false positive wouldn't be the end of the world. But for code clarity and (future) robustness, be explicit about this case. Bail on get_shadow_from_swap_cache() returning NULL.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-17 17:19 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < b79f9e1ff27c994a4c452235ba09e672ec698e23 (git)
Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < d962f6c583458037dc7e529659b2b02b9dd3d94b (git)
Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < 24a0e73d544439bb9329fbbafac44299e548a677 (git)
Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < d5d39c707a4cf0bcc84680178677b97aa2cb2627 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.24 , ≤ 6.6.* (semver)
Unaffected: 6.7.12 , ≤ 6.7.* (semver)
Unaffected: 6.8.3 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T17:19:03.392959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T16:52:46.185Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.505Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b79f9e1ff27c994a4c452235ba09e672ec698e23",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "d962f6c583458037dc7e529659b2b02b9dd3d94b",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "24a0e73d544439bb9329fbbafac44299e548a677",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "d5d39c707a4cf0bcc84680178677b97aa2cb2627",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: cachestat: fix two shmem bugs\n\nWhen cachestat on shmem races with swapping and invalidation, there\nare two possible bugs:\n\n1) A swapin error can have resulted in a poisoned swap entry in the\n   shmem inode\u0027s xarray. Calling get_shadow_from_swap_cache() on it\n   will result in an out-of-bounds access to swapper_spaces[].\n\n   Validate the entry with non_swap_entry() before going further.\n\n2) When we find a valid swap entry in the shmem\u0027s inode, the shadow\n   entry in the swapcache might not exist yet: swap IO is still in\n   progress and we\u0027re before __remove_mapping; swapin, invalidation,\n   or swapoff have removed the shadow from swapcache after we saw the\n   shmem swap entry.\n\n   This will send a NULL to workingset_test_recent(). The latter\n   purely operates on pointer bits, so it won\u0027t crash - node 0, memcg\n   ID 0, eviction timestamp 0, etc. are all valid inputs - but it\u0027s a\n   bogus test. In theory that could result in a false \"recently\n   evicted\" count.\n\n   Such a false positive wouldn\u0027t be the end of the world. But for\n   code clarity and (future) robustness, be explicit about this case.\n\n   Bail on get_shadow_from_swap_cache() returning NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the `cachestat(2)` syscall on a local file descriptor for a shmem/tmpfs mapping (memfd, /dev/shm, or any readable tmpfs file). There is no network or remote-peer path into `filemap_cachestat()`.\nAC:L - Once a poisoned swap entry exists in a shmem inode it persists until truncate, and every `cachestat()` call covering that index deterministically and repeatably performs the out-of-bounds `swapper_spaces[]` access; the attacker additionally controls both sides of the cachestat-vs-swapping/invalidation race and can drive unbounded shmem swap I/O (large tmpfs files plus memory pressure) to provoke the swapin error, which is routine on flash-backed embedded/IoT swap and network-backed swap in diskless/cloud deployments.\nPR:L - `cachestat(2)` performs only `fdget()` with no capability or permission check whatsoever in the affected versions, and any unprivileged user can create a shmem mapping via `memfd_create()` or `/dev/shm`. No elevated privileges or namespace tricks are needed.\nUI:N - The attacker triggers the flaw entirely from their own process with a single syscall on a file descriptor they already hold. No action by any other user or victim process is required.\nS:U - The out-of-bounds access, wild dereference and resulting oops are all confined to the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The read past the end of `swapper_spaces[]` yields an unvalidated non-pointer value that is dereferenced as a `struct address_space` and walked as an xarray, so the kernel reads memory at an address it never bounds-checked; the value derived from that walk feeds `workingset_test_recent()` whose outcome is reflected in the `nr_recently_evicted` field copied back to userspace, forming a kernel-memory disclosure oracle. This is an unbounded out-of-bounds read, not a read strictly limited to a few bytes.\nI:N - The faulty path only performs reads (`xa_load`), and the memcg reference taken in `workingset_test_recent()` is released on all paths, so no kernel memory is written or corrupted and no write or control-flow-hijack primitive is produced. The only integrity effect is an inaccurate statistics counter returned to the caller.\nA:H - The out-of-bounds `swapper_spaces[31]` value is almost always zero (or unmapped garbage), producing a NULL/wild pointer dereference and kernel oops inside an `rcu_read_lock()` critical section; the leaked RCU nesting on task death can escalate to RCU stalls and a system-wide hang, and `panic_on_oops` systems panic outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:00.460Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"
        },
        {
          "url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"
        },
        {
          "url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"
        }
      ],
      "title": "mm: cachestat: fix two shmem bugs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35797",
    "datePublished": "2024-05-17T13:23:08.204Z",
    "dateReserved": "2024-05-17T12:19:12.340Z",
    "dateUpdated": "2026-08-05T11:30:00.460Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35797",
      "date": "2026-09-08",
      "epss": "0.00667",
      "percentile": "0.49597"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35797\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T14:15:11.937\",\"lastModified\":\"2026-08-04T11:17:53.760\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: cachestat: fix two shmem bugs\\n\\nWhen cachestat on shmem races with swapping and invalidation, there\\nare two possible bugs:\\n\\n1) A swapin error can have resulted in a poisoned swap entry in the\\n   shmem inode\u0027s xarray. Calling get_shadow_from_swap_cache() on it\\n   will result in an out-of-bounds access to swapper_spaces[].\\n\\n   Validate the entry with non_swap_entry() before going further.\\n\\n2) When we find a valid swap entry in the shmem\u0027s inode, the shadow\\n   entry in the swapcache might not exist yet: swap IO is still in\\n   progress and we\u0027re before __remove_mapping; swapin, invalidation,\\n   or swapoff have removed the shadow from swapcache after we saw the\\n   shmem swap entry.\\n\\n   This will send a NULL to workingset_test_recent(). The latter\\n   purely operates on pointer bits, so it won\u0027t crash - node 0, memcg\\n   ID 0, eviction timestamp 0, etc. are all valid inputs - but it\u0027s a\\n   bogus test. In theory that could result in a false \\\"recently\\n   evicted\\\" count.\\n\\n   Such a false positive wouldn\u0027t be the end of the world. But for\\n   code clarity and (future) robustness, be explicit about this case.\\n\\n   Bail on get_shadow_from_swap_cache() returning NULL.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: cachestat: corrige dos errores de shmem Cuando cachestat en shmem se ejecuta con intercambio e invalidaci\u00f3n, hay dos errores posibles: 1) Un error de intercambio puede haber resultado en una entrada de intercambio envenenada en la matriz x del inodo shmem. Llamar a get_shadow_from_swap_cache() dar\u00e1 como resultado un acceso fuera de los l\u00edmites a swapper_spaces[]. Valide la entrada con non_swap_entry() antes de continuar. 2) Cuando encontramos una entrada de intercambio v\u00e1lida en el inodo de shmem, es posible que la entrada oculta en el cach\u00e9 de intercambio a\u00fan no exista: el intercambio de E/S a\u00fan est\u00e1 en progreso y estamos antes de __remove_mapping; swapin, invalidaci\u00f3n o swapoff han eliminado la sombra de swapcache despu\u00e9s de que vimos la entrada de intercambio shmem. Esto enviar\u00e1 un NULL aworkingset_test_recent(). Este \u00faltimo opera exclusivamente con bits de puntero, por lo que no fallar\u00e1 (el nodo 0, el ID de memcg 0, la marca de tiempo de desalojo 0, etc. son todas entradas v\u00e1lidas), pero es una prueba falsa. En teor\u00eda, eso podr\u00eda resultar en un recuento falso de \\\"desalojados recientemente\\\". Un falso positivo as\u00ed no ser\u00eda el fin del mundo. Pero para mayor claridad del c\u00f3digo y solidez (futura), sea expl\u00edcito sobre este caso. Libere get_shadow_from_swap_cache() y devuelva NULL.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/filemap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cf264e1329fb0307e044f7675849f9f38b44c11a\",\"lessThan\":\"b79f9e1ff27c994a4c452235ba09e672ec698e23\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf264e1329fb0307e044f7675849f9f38b44c11a\",\"lessThan\":\"d962f6c583458037dc7e529659b2b02b9dd3d94b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf264e1329fb0307e044f7675849f9f38b44c11a\",\"lessThan\":\"24a0e73d544439bb9329fbbafac44299e548a677\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf264e1329fb0307e044f7675849f9f38b44c11a\",\"lessThan\":\"d5d39c707a4cf0bcc84680178677b97aa2cb2627\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/filemap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.24\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.12\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.3\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-17T17:19:03.392959Z\",\"id\":\"CVE-2024-35797\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.24\",\"matchCriteriaId\":\"A2469D58-C2A6-4C9E-9A71-83830808C4FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.12\",\"matchCriteriaId\":\"6BE9771A-BAFD-4624-95F9-58D536540C53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.3\",\"matchCriteriaId\":\"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:44:52+00:00",
      "cve": "CVE-2024-35797",
      "id": "CVE-2024-35797",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: cachestat: fix two shmem bugs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35797.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:47.505Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35797\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-17T17:19:03.392959Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.714Z\"}}], \"cna\": {\"title\": \"mm: cachestat: fix two shmem bugs\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached only through the `cachestat(2)` syscall on a local file descriptor for a shmem/tmpfs mapping (memfd, /dev/shm, or any readable tmpfs file). There is no network or remote-peer path into `filemap_cachestat()`.\\nAC:L - Once a poisoned swap entry exists in a shmem inode it persists until truncate, and every `cachestat()` call covering that index deterministically and repeatably performs the out-of-bounds `swapper_spaces[]` access; the attacker additionally controls both sides of the cachestat-vs-swapping/invalidation race and can drive unbounded shmem swap I/O (large tmpfs files plus memory pressure) to provoke the swapin error, which is routine on flash-backed embedded/IoT swap and network-backed swap in diskless/cloud deployments.\\nPR:L - `cachestat(2)` performs only `fdget()` with no capability or permission check whatsoever in the affected versions, and any unprivileged user can create a shmem mapping via `memfd_create()` or `/dev/shm`. No elevated privileges or namespace tricks are needed.\\nUI:N - The attacker triggers the flaw entirely from their own process with a single syscall on a file descriptor they already hold. No action by any other user or victim process is required.\\nS:U - The out-of-bounds access, wild dereference and resulting oops are all confined to the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The read past the end of `swapper_spaces[]` yields an unvalidated non-pointer value that is dereferenced as a `struct address_space` and walked as an xarray, so the kernel reads memory at an address it never bounds-checked; the value derived from that walk feeds `workingset_test_recent()` whose outcome is reflected in the `nr_recently_evicted` field copied back to userspace, forming a kernel-memory disclosure oracle. This is an unbounded out-of-bounds read, not a read strictly limited to a few bytes.\\nI:N - The faulty path only performs reads (`xa_load`), and the memcg reference taken in `workingset_test_recent()` is released on all paths, so no kernel memory is written or corrupted and no write or control-flow-hijack primitive is produced. The only integrity effect is an inaccurate statistics counter returned to the caller.\\nA:H - The out-of-bounds `swapper_spaces[31]` value is almost always zero (or unmapped garbage), producing a NULL/wild pointer dereference and kernel oops inside an `rcu_read_lock()` critical section; the leaked RCU nesting on task death can escalate to RCU stalls and a system-wide hang, and `panic_on_oops` systems panic outright.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"cf264e1329fb0307e044f7675849f9f38b44c11a\", \"lessThan\": \"b79f9e1ff27c994a4c452235ba09e672ec698e23\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cf264e1329fb0307e044f7675849f9f38b44c11a\", \"lessThan\": \"d962f6c583458037dc7e529659b2b02b9dd3d94b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cf264e1329fb0307e044f7675849f9f38b44c11a\", \"lessThan\": \"24a0e73d544439bb9329fbbafac44299e548a677\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cf264e1329fb0307e044f7675849f9f38b44c11a\", \"lessThan\": \"d5d39c707a4cf0bcc84680178677b97aa2cb2627\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/filemap.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/filemap.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23\"}, {\"url\": \"https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b\"}, {\"url\": \"https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677\"}, {\"url\": \"https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: cachestat: fix two shmem bugs\\n\\nWhen cachestat on shmem races with swapping and invalidation, there\\nare two possible bugs:\\n\\n1) A swapin error can have resulted in a poisoned swap entry in the\\n   shmem inode\u0027s xarray. Calling get_shadow_from_swap_cache() on it\\n   will result in an out-of-bounds access to swapper_spaces[].\\n\\n   Validate the entry with non_swap_entry() before going further.\\n\\n2) When we find a valid swap entry in the shmem\u0027s inode, the shadow\\n   entry in the swapcache might not exist yet: swap IO is still in\\n   progress and we\u0027re before __remove_mapping; swapin, invalidation,\\n   or swapoff have removed the shadow from swapcache after we saw the\\n   shmem swap entry.\\n\\n   This will send a NULL to workingset_test_recent(). The latter\\n   purely operates on pointer bits, so it won\u0027t crash - node 0, memcg\\n   ID 0, eviction timestamp 0, etc. are all valid inputs - but it\u0027s a\\n   bogus test. In theory that could result in a false \\\"recently\\n   evicted\\\" count.\\n\\n   Such a false positive wouldn\u0027t be the end of the world. But for\\n   code clarity and (future) robustness, be explicit about this case.\\n\\n   Bail on get_shadow_from_swap_cache() returning NULL.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.24\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.12\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.3\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:00.460Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35797\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:00.460Z\", \"dateReserved\": \"2024-05-17T12:19:12.340Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T13:23:08.204Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.