{
  "cveId": "CVE-2024-35929",
  "url": "https://patchblox.com/security/cve/CVE-2024-35929",
  "summary": "CVE-2024-35929 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-35929, released May 19, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_byp...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()  For the kernels built with CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y and CONFIG_RCU_LAZY=y, the following scenarios will trigger WARN_ON_ONCE() in the rcu_nocb_bypass_lock() and rcu_nocb_wait_contended() functions:          CPU2                                               CPU11 kthread rcu_nocb_cb_kthread                                       ksys_write rcu_do_batch                                              vfs_write rcu_torture_timer_cb                                      proc_sys_write __kmem_cache_free                                         proc_sys_call_handler kmemleak_free                                             drop_caches_sysctl_handler delete_object_full                                        drop_slab __delete_object                                           shrink_slab put_object                                                lazy_rcu_shrink_scan call_rcu                                                  rcu_nocb_flush_bypass __call_rcu_commn                                            rcu_nocb_bypass_lock                                                             raw_spin_trylock(\u0026rdp-\u003Enocb_bypass_lock) fail                                                             atomic_inc(\u0026rdp-\u003Enocb_lock_contended); rcu_nocb_wait_contended                                     WARN_ON_ONCE(smp_processor_id() != rdp-\u003Ecpu);  WARN_ON_ONCE(atomic_read(\u0026rdp-\u003Enocb_lock_contended))                                          |                             |_ _ _ _ _ _ _ _ _ _same rdp and rdp-\u003Ecpu != 11_ _ _ _ _ _ _ _ _ __|  Reproduce this bug with \u0022echo 3 \u003E /proc/sys/vm/drop_caches\u0022.  This commit therefore uses rcu_nocb_try_flush_bypass() instead of rcu_nocb_flush_bypass() in lazy_rcu_shrink_scan().  If the nocb_bypass queue is being flushed, then rcu_nocb_try_flush_bypass will return directly.",
  "published": "2024-05-19T11:15:48Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00222,
  "epssPercentile": 0.12836,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.8.9-1",
      "fix": "DEBIAN-CVE-2024-35929",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-35929",
      "released": "2024-05-19T11:15:48Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.8.9-1",
      "fix": "DEBIAN-CVE-2024-35929",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-35929",
      "released": "2024-05-19T11:15:48Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}