CVE-2024-35814 – A double-allocation vulnerability in the Linux ... (How to Fix)

Q: What is the severity of CVE-2024-35814?

CVE-2024-35814 has a CVSS score of 8.8 (HIGH). A double-allocation vulnerability in the Linux kernel's SWIOTLB subsystem allows memory corruption when handling DMA allocations with specific alignment requirements. This affects systems using SWIOTLB for DMA bouncing, particularly virtual machines with restricted DMA pools. Exploitation can lead to system crashes, hangs, or data corruption.

📋 TL;DR

A double-allocation vulnerability in the Linux kernel's SWIOTLB subsystem allows memory corruption when handling DMA allocations with specific alignment requirements. This affects systems using SWIOTLB for DMA bouncing, particularly virtual machines with restricted DMA pools. Exploitation can lead to system crashes, hangs, or data corruption.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions containing commits bbb73a103fbb through the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires SWIOTLB usage with specific alignment conditions, commonly triggered in virtual machines with restricted DMA pools using vsock devices.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System crash, kernel panic, or persistent data corruption leading to complete system instability and potential data loss.

🟠

Likely Case

System hangs, crashes, or unpredictable behavior in virtual machines using vsock with restricted DMA SWIOTLB pools.

🟢

If Mitigated

No impact if SWIOTLB is not used or if systems are patched with the kernel fix.

🌐 Internet-Facing: LOW - This is a kernel-level memory management issue requiring local access or specific DMA operations.

🏢 Internal Only: MEDIUM - Virtual machines and systems using SWIOTLB for DMA operations are vulnerable to instability and crashes.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH - Requires specific DMA allocation patterns and SWIOTLB configuration.

Exploitation requires triggering the double-allocation through DMA operations, typically in virtualized environments.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits 04867a7a33324c9c562ee7949dbcaab7aaad1fb4 and related stable backports

Vendor Advisory: https://git.kernel.org/stable/c/04867a7a33324c9c562ee7949dbcaab7aaad1fb4

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing fix commits. 2. Check distribution security advisories for specific patched versions. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable SWIOTLB

linux

Prevent use of SWIOTLB subsystem if not required for system operation

Add 'swiotlb=0' to kernel boot parameters

Avoid restricted DMA pools

linux

Configure virtual machines to avoid restricted DMA SWIOTLB usage

🧯 If You Can't Patch

Monitor system logs for SWIOTLB allocation errors or vsock-related crashes
Isolate affected virtual machines and consider migrating workloads to unaffected systems

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if SWIOTLB is active: cat /proc/cmdline | grep swiotlb && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits: grep -q '04867a7a33324c9c562ee7949dbcaab7aaad1fb4' /proc/version_signature || echo 'Check distribution patch status'

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
SWIOTLB allocation errors in dmesg
vsock device failures

Network Indicators:

Unusual virtual machine communication failures

SIEM Query:

source="kernel" AND ("swiotlb" OR "double allocation" OR "vsock")

📊 Metadata

CVE ID: CVE-2024-35814

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-415

Published: May 17, 2024

Last Updated: September 19, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35814, you might also want to check these: