CVE-2024-35926: crypto: iaa - Fix async_disable descriptor leak
In the Linux kernel, the following vulnerability has been resolved:
crypto: iaa - Fix asyncdisable descriptor leak
The disableasync paths of iaacompress/decompress() don't free idxd descriptors in the asyncdisable case. Currently this only happens in the testcases where req->dst is set to null. Add a test to free them in those paths.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35926?
The severity of CVE-2024-35926 is classified as moderate due to a potential descriptor leak in the Linux kernel's async_disable paths.
How do I fix CVE-2024-35926?
To fix CVE-2024-35926, upgrade to the patched versions of the Linux kernel: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What software is affected by CVE-2024-35926?
CVE-2024-35926 affects specific versions of the Linux kernel in Debian packages.
What does CVE-2024-35926 impact?
CVE-2024-35926 impacts the handling of idxd descriptors in the Linux kernel's asynchronous I/O operations.
Is CVE-2024-35926 exploitable in production systems?
While exploitation of CVE-2024-35926 is possible, it primarily requires specific conditions met in test environments rather than typical production systems.