CVE-2024-35797mm: cachestat: fix two shmem bugs
- 7.1HighCVSS base score
- 0.67%Exploitation in 30 daysEPSS · top 48% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1) A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling get_shadow_from_swap_cache() on it will result in an out-of-bounds access to swapper_spaces[]. Validate the entry with non_swap_entry() before going further. 2) When we find a valid swap entry in the shmem's inode, the shadow entry in the swapcache might not exist yet: swap IO is still in progress and we're before __remove_mapping; swapin, invalidation, or swapoff have removed the shadow from swapcache after we saw the shmem swap entry. This will send a NULL to workingset_test_recent(). The latter purely operates on pointer bits, so it won't crash - node 0, memcg ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a bogus test. In theory that could result in a false "recently evicted" count. Such a false positive wouldn't be the end of the world. But for code clarity and (future) robustness, be explicit about this case. Bail on get_shadow_from_swap_cache() returning NULL.
Timeline
ID reserved
By Linux
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
| CISA-ADPADP (enrichment) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.67% · top 48% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Affected products
- affected cf264e1329fb0307e044f7675849f9f38b44c11a – < b79f9e1ff27c994a4c452235ba09e672ec698e23
- affected cf264e1329fb0307e044f7675849f9f38b44c11a – < d962f6c583458037dc7e529659b2b02b9dd3d94b
- affected cf264e1329fb0307e044f7675849f9f38b44c11a – < 24a0e73d544439bb9329fbbafac44299e548a677
- affected cf264e1329fb0307e044f7675849f9f38b44c11a – < d5d39c707a4cf0bcc84680178677b97aa2cb2627
- affected 6.5
- unaffected < 6.5
- unaffected 6.6.24 – ≤ 6.6.*
- unaffected 6.7.12 – ≤ 6.7.*
- unaffected 6.8.3 – ≤ 6.8.*
- unaffected 6.9 – ≤ *
References
References4
- https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627 (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-35790 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-35797)Record last updated .