GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-35809 (GCVE-0-2024-35809)

Vulnerability from cvelistv5 – Published: 2024-05-17 13:23 – Updated: 2026-05-11 20:11
VLAI
Title
PCI/PM: Drain runtime-idle callbacks before driver removal
Summary
In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal A race condition between the .runtime_idle() callback and the .remove() callback in the rtsx_pcr PCI driver leads to a kernel crash due to an unhandled page fault [1]. The problem is that rtsx_pci_runtime_idle() is not expected to be running after pm_runtime_get_sync() has been called, but the latter doesn't really guarantee that. It only guarantees that the suspend and resume callbacks will not be running when it returns. However, if a .runtime_idle() callback is already running when pm_runtime_get_sync() is called, the latter will notice that the runtime PM status of the device is RPM_ACTIVE and it will return right away without waiting for the former to complete. In fact, it cannot wait for .runtime_idle() to complete because it may be called from that callback (it arguably does not make much sense to do that, but it is not strictly prohibited). Thus in general, whoever is providing a .runtime_idle() callback needs to protect it from running in parallel with whatever code runs after pm_runtime_get_sync(). [Note that .runtime_idle() will not start after pm_runtime_get_sync() has returned, but it may continue running then if it has started earlier.] One way to address that race condition is to call pm_runtime_barrier() after pm_runtime_get_sync() (not before it, because a nonzero value of the runtime PM usage counter is necessary to prevent runtime PM callbacks from being invoked) to wait for the .runtime_idle() callback to complete should it be running at that point. A suitable place for doing that is in pci_device_remove() which calls pm_runtime_get_sync() before removing the driver, so it may as well call pm_runtime_barrier() subsequently, which will prevent the race in question from occurring, not just in the rtsx_pcr driver, but in any PCI drivers providing .runtime_idle() callbacks.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-31 18:40 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f3ec4f87d607f40497afdb5ac03f11e2ea253d52 , < 9a87375bb586515c0af63d5dcdcd58ec4acf20a6 (git)
Affected: f3ec4f87d607f40497afdb5ac03f11e2ea253d52 , < 47d8aafcfe313511a98f165a54d0adceb34e54b1 (git)
Affected: f3ec4f87d607f40497afdb5ac03f11e2ea253d52 , < bbe068b24409ef740657215605284fc7cdddd491 (git)
Affected: f3ec4f87d607f40497afdb5ac03f11e2ea253d52 , < 7cc94dd36e48879e76ae7a8daea4ff322b7d9674 (git)
Affected: f3ec4f87d607f40497afdb5ac03f11e2ea253d52 , < 900b81caf00c89417172afe0e7e49ac4eb110f4b (git)
Affected: f3ec4f87d607f40497afdb5ac03f11e2ea253d52 , < d86ad8c3e152349454b82f37007ff6ba45f26989 (git)
Affected: f3ec4f87d607f40497afdb5ac03f11e2ea253d52 , < d534198311c345e4b062c4b88bb609efb8bd91d5 (git)
Affected: f3ec4f87d607f40497afdb5ac03f11e2ea253d52 , < 6347348c6aba52dda0b33296684cbb627bdc6970 (git)
Affected: f3ec4f87d607f40497afdb5ac03f11e2ea253d52 , < 9d5286d4e7f68beab450deddbb6a32edd5ecf4bf (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.36
Unaffected: 0 , < 2.6.36 (semver)
Unaffected: 4.19.312 , ≤ 4.19.* (semver)
Unaffected: 5.4.274 , ≤ 5.4.* (semver)
Unaffected: 5.10.215 , ≤ 5.10.* (semver)
Unaffected: 5.15.154 , ≤ 5.15.* (semver)
Unaffected: 6.1.84 , ≤ 6.1.* (semver)
Unaffected: 6.6.24 , ≤ 6.6.* (semver)
Unaffected: 6.7.12 , ≤ 6.7.* (semver)
Unaffected: 6.8.3 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35809",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-31T18:40:16.396244Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-29T19:25:02.357Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.494Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9a87375bb586515c0af63d5dcdcd58ec4acf20a6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/47d8aafcfe313511a98f165a54d0adceb34e54b1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bbe068b24409ef740657215605284fc7cdddd491"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7cc94dd36e48879e76ae7a8daea4ff322b7d9674"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/900b81caf00c89417172afe0e7e49ac4eb110f4b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d86ad8c3e152349454b82f37007ff6ba45f26989"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d534198311c345e4b062c4b88bb609efb8bd91d5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6347348c6aba52dda0b33296684cbb627bdc6970"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9d5286d4e7f68beab450deddbb6a32edd5ecf4bf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/pci-driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a87375bb586515c0af63d5dcdcd58ec4acf20a6",
              "status": "affected",
              "version": "f3ec4f87d607f40497afdb5ac03f11e2ea253d52",
              "versionType": "git"
            },
            {
              "lessThan": "47d8aafcfe313511a98f165a54d0adceb34e54b1",
              "status": "affected",
              "version": "f3ec4f87d607f40497afdb5ac03f11e2ea253d52",
              "versionType": "git"
            },
            {
              "lessThan": "bbe068b24409ef740657215605284fc7cdddd491",
              "status": "affected",
              "version": "f3ec4f87d607f40497afdb5ac03f11e2ea253d52",
              "versionType": "git"
            },
            {
              "lessThan": "7cc94dd36e48879e76ae7a8daea4ff322b7d9674",
              "status": "affected",
              "version": "f3ec4f87d607f40497afdb5ac03f11e2ea253d52",
              "versionType": "git"
            },
            {
              "lessThan": "900b81caf00c89417172afe0e7e49ac4eb110f4b",
              "status": "affected",
              "version": "f3ec4f87d607f40497afdb5ac03f11e2ea253d52",
              "versionType": "git"
            },
            {
              "lessThan": "d86ad8c3e152349454b82f37007ff6ba45f26989",
              "status": "affected",
              "version": "f3ec4f87d607f40497afdb5ac03f11e2ea253d52",
              "versionType": "git"
            },
            {
              "lessThan": "d534198311c345e4b062c4b88bb609efb8bd91d5",
              "status": "affected",
              "version": "f3ec4f87d607f40497afdb5ac03f11e2ea253d52",
              "versionType": "git"
            },
            {
              "lessThan": "6347348c6aba52dda0b33296684cbb627bdc6970",
              "status": "affected",
              "version": "f3ec4f87d607f40497afdb5ac03f11e2ea253d52",
              "versionType": "git"
            },
            {
              "lessThan": "9d5286d4e7f68beab450deddbb6a32edd5ecf4bf",
              "status": "affected",
              "version": "f3ec4f87d607f40497afdb5ac03f11e2ea253d52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/pci-driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.312",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.274",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/PM: Drain runtime-idle callbacks before driver removal\n\nA race condition between the .runtime_idle() callback and the .remove()\ncallback in the rtsx_pcr PCI driver leads to a kernel crash due to an\nunhandled page fault [1].\n\nThe problem is that rtsx_pci_runtime_idle() is not expected to be running\nafter pm_runtime_get_sync() has been called, but the latter doesn\u0027t really\nguarantee that.  It only guarantees that the suspend and resume callbacks\nwill not be running when it returns.\n\nHowever, if a .runtime_idle() callback is already running when\npm_runtime_get_sync() is called, the latter will notice that the runtime PM\nstatus of the device is RPM_ACTIVE and it will return right away without\nwaiting for the former to complete.  In fact, it cannot wait for\n.runtime_idle() to complete because it may be called from that callback (it\narguably does not make much sense to do that, but it is not strictly\nprohibited).\n\nThus in general, whoever is providing a .runtime_idle() callback needs\nto protect it from running in parallel with whatever code runs after\npm_runtime_get_sync().  [Note that .runtime_idle() will not start after\npm_runtime_get_sync() has returned, but it may continue running then if it\nhas started earlier.]\n\nOne way to address that race condition is to call pm_runtime_barrier()\nafter pm_runtime_get_sync() (not before it, because a nonzero value of the\nruntime PM usage counter is necessary to prevent runtime PM callbacks from\nbeing invoked) to wait for the .runtime_idle() callback to complete should\nit be running at that point.  A suitable place for doing that is in\npci_device_remove() which calls pm_runtime_get_sync() before removing the\ndriver, so it may as well call pm_runtime_barrier() subsequently, which\nwill prevent the race in question from occurring, not just in the rtsx_pcr\ndriver, but in any PCI drivers providing .runtime_idle() callbacks."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:11:26.724Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a87375bb586515c0af63d5dcdcd58ec4acf20a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/47d8aafcfe313511a98f165a54d0adceb34e54b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbe068b24409ef740657215605284fc7cdddd491"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cc94dd36e48879e76ae7a8daea4ff322b7d9674"
        },
        {
          "url": "https://git.kernel.org/stable/c/900b81caf00c89417172afe0e7e49ac4eb110f4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d86ad8c3e152349454b82f37007ff6ba45f26989"
        },
        {
          "url": "https://git.kernel.org/stable/c/d534198311c345e4b062c4b88bb609efb8bd91d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6347348c6aba52dda0b33296684cbb627bdc6970"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d5286d4e7f68beab450deddbb6a32edd5ecf4bf"
        }
      ],
      "title": "PCI/PM: Drain runtime-idle callbacks before driver removal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35809",
    "datePublished": "2024-05-17T13:23:16.168Z",
    "dateReserved": "2024-05-17T12:19:12.342Z",
    "dateUpdated": "2026-05-11T20:11:26.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35809",
      "date": "2026-09-15",
      "epss": "0.00195",
      "percentile": "0.0937"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPCI/PM: Drain runtime-idle callbacks before driver removal\\n\\nA race condition between the .runtime_idle() callback and the .remove()\\ncallback in the rtsx_pcr PCI driver leads to a kernel crash due to an\\nunhandled page fault [1].\\n\\nThe problem is that rtsx_pci_runtime_idle() is not expected to be running\\nafter pm_runtime_get_sync() has been called, but the latter doesn\u0027t really\\nguarantee that.  It only guarantees that the suspend and resume callbacks\\nwill not be running when it returns.\\n\\nHowever, if a .runtime_idle() callback is already running when\\npm_runtime_get_sync() is called, the latter will notice that the runtime PM\\nstatus of the device is RPM_ACTIVE and it will return right away without\\nwaiting for the former to complete.  In fact, it cannot wait for\\n.runtime_idle() to complete because it may be called from that callback (it\\narguably does not make much sense to do that, but it is not strictly\\nprohibited).\\n\\nThus in general, whoever is providing a .runtime_idle() callback needs\\nto protect it from running in parallel with whatever code runs after\\npm_runtime_get_sync().  [Note that .runtime_idle() will not start after\\npm_runtime_get_sync() has returned, but it may continue running then if it\\nhas started earlier.]\\n\\nOne way to address that race condition is to call pm_runtime_barrier()\\nafter pm_runtime_get_sync() (not before it, because a nonzero value of the\\nruntime PM usage counter is necessary to prevent runtime PM callbacks from\\nbeing invoked) to wait for the .runtime_idle() callback to complete should\\nit be running at that point.  A suitable place for doing that is in\\npci_device_remove() which calls pm_runtime_get_sync() before removing the\\ndriver, so it may as well call pm_runtime_barrier() subsequently, which\\nwill prevent the race in question from occurring, not just in the rtsx_pcr\\ndriver, but in any PCI drivers providing .runtime_idle() callbacks.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PCI/PM: drena las devoluciones de llamada inactivas en tiempo de ejecuci\\u00f3n antes de eliminar el controlador. Una condici\\u00f3n de ejecuci\\u00f3n entre la devoluci\\u00f3n de llamada .runtime_idle() y la devoluci\\u00f3n de llamada .remove() en el controlador PCI rtsx_pcr conduce a un crash de kernel debido a un error de p\\u00e1gina no controlado [1]. El problema es que no se espera que rtsx_pci_runtime_idle() se ejecute despu\\u00e9s de llamar a pm_runtime_get_sync(), pero esto \\u00faltimo realmente no garantiza eso. Solo garantiza que las devoluciones de llamada de suspensi\\u00f3n y reanudaci\\u00f3n no se ejecutar\\u00e1n cuando regrese. Sin embargo, si ya se est\\u00e1 ejecutando una devoluci\\u00f3n de llamada .runtime_idle() cuando se llama a pm_runtime_get_sync(), este \\u00faltimo notar\\u00e1 que el estado de PM en tiempo de ejecuci\\u00f3n del dispositivo es RPM_ACTIVE y regresar\\u00e1 de inmediato sin esperar a que se complete el primero. De hecho, no puede esperar a que se complete .runtime_idle() porque puede ser llamado desde esa devoluci\\u00f3n de llamada (podr\\u00eda decirse que no tiene mucho sentido hacerlo, pero no est\\u00e1 estrictamente prohibido). Por lo tanto, en general, quien proporciona una devoluci\\u00f3n de llamada .runtime_idle() debe protegerla para que no se ejecute en paralelo con cualquier c\\u00f3digo que se ejecute despu\\u00e9s de pm_runtime_get_sync(). [Tenga en cuenta que .runtime_idle() no se iniciar\\u00e1 despu\\u00e9s de que pm_runtime_get_sync() haya regresado, pero puede continuar ejecut\\u00e1ndose si comenz\\u00f3 antes.] Una forma de abordar esa condici\\u00f3n de ejecuci\\u00f3n es llamar a pm_runtime_barrier() despu\\u00e9s de pm_runtime_get_sync() (no antes porque es necesario un valor distinto de cero del contador de uso de PM en tiempo de ejecuci\\u00f3n para evitar que se invoquen devoluciones de llamada de PM en tiempo de ejecuci\\u00f3n) para esperar a que se complete la devoluci\\u00f3n de llamada .runtime_idle() en caso de que se est\\u00e9 ejecutando en ese punto. Un lugar adecuado para hacerlo es pci_device_remove() que llama a pm_runtime_get_sync() antes de eliminar el controlador, por lo que tambi\\u00e9n puede llamar a pm_runtime_barrier() posteriormente, lo que evitar\\u00e1 que se produzca la ejecuci\\u00f3n en cuesti\\u00f3n, no s\\u00f3lo en el controlador rtsx_pcr, sino en cualquier controlador PCI que proporcione devoluciones de llamada .runtime_idle().\"}]",
      "id": "CVE-2024-35809",
      "lastModified": "2024-11-21T09:20:56.760",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-17T14:15:14.730",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/47d8aafcfe313511a98f165a54d0adceb34e54b1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/6347348c6aba52dda0b33296684cbb627bdc6970\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7cc94dd36e48879e76ae7a8daea4ff322b7d9674\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/900b81caf00c89417172afe0e7e49ac4eb110f4b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9a87375bb586515c0af63d5dcdcd58ec4acf20a6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9d5286d4e7f68beab450deddbb6a32edd5ecf4bf\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/bbe068b24409ef740657215605284fc7cdddd491\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d534198311c345e4b062c4b88bb609efb8bd91d5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d86ad8c3e152349454b82f37007ff6ba45f26989\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/47d8aafcfe313511a98f165a54d0adceb34e54b1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/6347348c6aba52dda0b33296684cbb627bdc6970\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7cc94dd36e48879e76ae7a8daea4ff322b7d9674\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/900b81caf00c89417172afe0e7e49ac4eb110f4b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9a87375bb586515c0af63d5dcdcd58ec4acf20a6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9d5286d4e7f68beab450deddbb6a32edd5ecf4bf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/bbe068b24409ef740657215605284fc7cdddd491\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d534198311c345e4b062c4b88bb609efb8bd91d5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d86ad8c3e152349454b82f37007ff6ba45f26989\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35809\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T14:15:14.730\",\"lastModified\":\"2026-06-17T07:35:27.053\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPCI/PM: Drain runtime-idle callbacks before driver removal\\n\\nA race condition between the .runtime_idle() callback and the .remove()\\ncallback in the rtsx_pcr PCI driver leads to a kernel crash due to an\\nunhandled page fault [1].\\n\\nThe problem is that rtsx_pci_runtime_idle() is not expected to be running\\nafter pm_runtime_get_sync() has been called, but the latter doesn\u0027t really\\nguarantee that.  It only guarantees that the suspend and resume callbacks\\nwill not be running when it returns.\\n\\nHowever, if a .runtime_idle() callback is already running when\\npm_runtime_get_sync() is called, the latter will notice that the runtime PM\\nstatus of the device is RPM_ACTIVE and it will return right away without\\nwaiting for the former to complete.  In fact, it cannot wait for\\n.runtime_idle() to complete because it may be called from that callback (it\\narguably does not make much sense to do that, but it is not strictly\\nprohibited).\\n\\nThus in general, whoever is providing a .runtime_idle() callback needs\\nto protect it from running in parallel with whatever code runs after\\npm_runtime_get_sync().  [Note that .runtime_idle() will not start after\\npm_runtime_get_sync() has returned, but it may continue running then if it\\nhas started earlier.]\\n\\nOne way to address that race condition is to call pm_runtime_barrier()\\nafter pm_runtime_get_sync() (not before it, because a nonzero value of the\\nruntime PM usage counter is necessary to prevent runtime PM callbacks from\\nbeing invoked) to wait for the .runtime_idle() callback to complete should\\nit be running at that point.  A suitable place for doing that is in\\npci_device_remove() which calls pm_runtime_get_sync() before removing the\\ndriver, so it may as well call pm_runtime_barrier() subsequently, which\\nwill prevent the race in question from occurring, not just in the rtsx_pcr\\ndriver, but in any PCI drivers providing .runtime_idle() callbacks.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PCI/PM: drena las devoluciones de llamada inactivas en tiempo de ejecuci\u00f3n antes de eliminar el controlador. Una condici\u00f3n de ejecuci\u00f3n entre la devoluci\u00f3n de llamada .runtime_idle() y la devoluci\u00f3n de llamada .remove() en el controlador PCI rtsx_pcr conduce a un crash de kernel debido a un error de p\u00e1gina no controlado [1]. El problema es que no se espera que rtsx_pci_runtime_idle() se ejecute despu\u00e9s de llamar a pm_runtime_get_sync(), pero esto \u00faltimo realmente no garantiza eso. Solo garantiza que las devoluciones de llamada de suspensi\u00f3n y reanudaci\u00f3n no se ejecutar\u00e1n cuando regrese. Sin embargo, si ya se est\u00e1 ejecutando una devoluci\u00f3n de llamada .runtime_idle() cuando se llama a pm_runtime_get_sync(), este \u00faltimo notar\u00e1 que el estado de PM en tiempo de ejecuci\u00f3n del dispositivo es RPM_ACTIVE y regresar\u00e1 de inmediato sin esperar a que se complete el primero. De hecho, no puede esperar a que se complete .runtime_idle() porque puede ser llamado desde esa devoluci\u00f3n de llamada (podr\u00eda decirse que no tiene mucho sentido hacerlo, pero no est\u00e1 estrictamente prohibido). Por lo tanto, en general, quien proporciona una devoluci\u00f3n de llamada .runtime_idle() debe protegerla para que no se ejecute en paralelo con cualquier c\u00f3digo que se ejecute despu\u00e9s de pm_runtime_get_sync(). [Tenga en cuenta que .runtime_idle() no se iniciar\u00e1 despu\u00e9s de que pm_runtime_get_sync() haya regresado, pero puede continuar ejecut\u00e1ndose si comenz\u00f3 antes.] Una forma de abordar esa condici\u00f3n de ejecuci\u00f3n es llamar a pm_runtime_barrier() despu\u00e9s de pm_runtime_get_sync() (no antes porque es necesario un valor distinto de cero del contador de uso de PM en tiempo de ejecuci\u00f3n para evitar que se invoquen devoluciones de llamada de PM en tiempo de ejecuci\u00f3n) para esperar a que se complete la devoluci\u00f3n de llamada .runtime_idle() en caso de que se est\u00e9 ejecutando en ese punto. Un lugar adecuado para hacerlo es pci_device_remove() que llama a pm_runtime_get_sync() antes de eliminar el controlador, por lo que tambi\u00e9n puede llamar a pm_runtime_barrier() posteriormente, lo que evitar\u00e1 que se produzca la ejecuci\u00f3n en cuesti\u00f3n, no s\u00f3lo en el controlador rtsx_pcr, sino en cualquier controlador PCI que proporcione devoluciones de llamada .runtime_idle().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/pci/pci-driver.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\",\"lessThan\":\"9a87375bb586515c0af63d5dcdcd58ec4acf20a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\",\"lessThan\":\"47d8aafcfe313511a98f165a54d0adceb34e54b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\",\"lessThan\":\"bbe068b24409ef740657215605284fc7cdddd491\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\",\"lessThan\":\"7cc94dd36e48879e76ae7a8daea4ff322b7d9674\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\",\"lessThan\":\"900b81caf00c89417172afe0e7e49ac4eb110f4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\",\"lessThan\":\"d86ad8c3e152349454b82f37007ff6ba45f26989\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\",\"lessThan\":\"d534198311c345e4b062c4b88bb609efb8bd91d5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\",\"lessThan\":\"6347348c6aba52dda0b33296684cbb627bdc6970\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\",\"lessThan\":\"9d5286d4e7f68beab450deddbb6a32edd5ecf4bf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/pci/pci-driver.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.36\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.36\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.312\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.274\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.215\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.154\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.84\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.24\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.12\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.3\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-31T18:40:16.396244Z\",\"id\":\"CVE-2024-35809\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.19.312\",\"matchCriteriaId\":\"23F858DD-6739-4BD9-9DA9-A9F5F66187C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.274\",\"matchCriteriaId\":\"F45A0F3C-C16D-49C4-86D6-D021C3D4B834\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.215\",\"matchCriteriaId\":\"9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.154\",\"matchCriteriaId\":\"577E212E-7E95-4A71-9B5C-F1D1A3AFFF46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.84\",\"matchCriteriaId\":\"834D9BD5-42A6-4D74-979E-4D6D93F630FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.24\",\"matchCriteriaId\":\"8018C1D0-0A5F-48D0-BC72-A2B33FDDA693\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.12\",\"matchCriteriaId\":\"6BE9771A-BAFD-4624-95F9-58D536540C53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.3\",\"matchCriteriaId\":\"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/47d8aafcfe313511a98f165a54d0adceb34e54b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6347348c6aba52dda0b33296684cbb627bdc6970\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7cc94dd36e48879e76ae7a8daea4ff322b7d9674\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/900b81caf00c89417172afe0e7e49ac4eb110f4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a87375bb586515c0af63d5dcdcd58ec4acf20a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9d5286d4e7f68beab450deddbb6a32edd5ecf4bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bbe068b24409ef740657215605284fc7cdddd491\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d534198311c345e4b062c4b88bb609efb8bd91d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d86ad8c3e152349454b82f37007ff6ba45f26989\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/47d8aafcfe313511a98f165a54d0adceb34e54b1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6347348c6aba52dda0b33296684cbb627bdc6970\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7cc94dd36e48879e76ae7a8daea4ff322b7d9674\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/900b81caf00c89417172afe0e7e49ac4eb110f4b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a87375bb586515c0af63d5dcdcd58ec4acf20a6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9d5286d4e7f68beab450deddbb6a32edd5ecf4bf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bbe068b24409ef740657215605284fc7cdddd491\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d534198311c345e4b062c4b88bb609efb8bd91d5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d86ad8c3e152349454b82f37007ff6ba45f26989\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:05:38+00:00",
      "cve": "CVE-2024-35809",
      "id": "CVE-2024-35809",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:fixed": "709",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: PCI/PM: Drain runtime-idle callbacks before driver removal",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35809.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:31:33Z",
      "cve": "CVE-2024-35809",
      "id": "CVE-2024-35809",
      "initial_release_date": "2024-05-21T02:00:12Z",
      "product_status:known_affected": "348",
      "product_status:recommended": "774",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35809",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35809.json",
      "version": "114"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9a87375bb586515c0af63d5dcdcd58ec4acf20a6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/47d8aafcfe313511a98f165a54d0adceb34e54b1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bbe068b24409ef740657215605284fc7cdddd491\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7cc94dd36e48879e76ae7a8daea4ff322b7d9674\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/900b81caf00c89417172afe0e7e49ac4eb110f4b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d86ad8c3e152349454b82f37007ff6ba45f26989\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d534198311c345e4b062c4b88bb609efb8bd91d5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6347348c6aba52dda0b33296684cbb627bdc6970\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9d5286d4e7f68beab450deddbb6a32edd5ecf4bf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:47.494Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35809\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-31T18:40:16.396244Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-31T18:40:20.690Z\"}}], \"cna\": {\"title\": \"PCI/PM: Drain runtime-idle callbacks before driver removal\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\", \"lessThan\": \"9a87375bb586515c0af63d5dcdcd58ec4acf20a6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\", \"lessThan\": \"47d8aafcfe313511a98f165a54d0adceb34e54b1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\", \"lessThan\": \"bbe068b24409ef740657215605284fc7cdddd491\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\", \"lessThan\": \"7cc94dd36e48879e76ae7a8daea4ff322b7d9674\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\", \"lessThan\": \"900b81caf00c89417172afe0e7e49ac4eb110f4b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\", \"lessThan\": \"d86ad8c3e152349454b82f37007ff6ba45f26989\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\", \"lessThan\": \"d534198311c345e4b062c4b88bb609efb8bd91d5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\", \"lessThan\": \"6347348c6aba52dda0b33296684cbb627bdc6970\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ec4f87d607f40497afdb5ac03f11e2ea253d52\", \"lessThan\": \"9d5286d4e7f68beab450deddbb6a32edd5ecf4bf\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/pci/pci-driver.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.36\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.36\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.312\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.274\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.215\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.154\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.84\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/pci/pci-driver.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9a87375bb586515c0af63d5dcdcd58ec4acf20a6\"}, {\"url\": \"https://git.kernel.org/stable/c/47d8aafcfe313511a98f165a54d0adceb34e54b1\"}, {\"url\": \"https://git.kernel.org/stable/c/bbe068b24409ef740657215605284fc7cdddd491\"}, {\"url\": \"https://git.kernel.org/stable/c/7cc94dd36e48879e76ae7a8daea4ff322b7d9674\"}, {\"url\": \"https://git.kernel.org/stable/c/900b81caf00c89417172afe0e7e49ac4eb110f4b\"}, {\"url\": \"https://git.kernel.org/stable/c/d86ad8c3e152349454b82f37007ff6ba45f26989\"}, {\"url\": \"https://git.kernel.org/stable/c/d534198311c345e4b062c4b88bb609efb8bd91d5\"}, {\"url\": \"https://git.kernel.org/stable/c/6347348c6aba52dda0b33296684cbb627bdc6970\"}, {\"url\": \"https://git.kernel.org/stable/c/9d5286d4e7f68beab450deddbb6a32edd5ecf4bf\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPCI/PM: Drain runtime-idle callbacks before driver removal\\n\\nA race condition between the .runtime_idle() callback and the .remove()\\ncallback in the rtsx_pcr PCI driver leads to a kernel crash due to an\\nunhandled page fault [1].\\n\\nThe problem is that rtsx_pci_runtime_idle() is not expected to be running\\nafter pm_runtime_get_sync() has been called, but the latter doesn\u0027t really\\nguarantee that.  It only guarantees that the suspend and resume callbacks\\nwill not be running when it returns.\\n\\nHowever, if a .runtime_idle() callback is already running when\\npm_runtime_get_sync() is called, the latter will notice that the runtime PM\\nstatus of the device is RPM_ACTIVE and it will return right away without\\nwaiting for the former to complete.  In fact, it cannot wait for\\n.runtime_idle() to complete because it may be called from that callback (it\\narguably does not make much sense to do that, but it is not strictly\\nprohibited).\\n\\nThus in general, whoever is providing a .runtime_idle() callback needs\\nto protect it from running in parallel with whatever code runs after\\npm_runtime_get_sync().  [Note that .runtime_idle() will not start after\\npm_runtime_get_sync() has returned, but it may continue running then if it\\nhas started earlier.]\\n\\nOne way to address that race condition is to call pm_runtime_barrier()\\nafter pm_runtime_get_sync() (not before it, because a nonzero value of the\\nruntime PM usage counter is necessary to prevent runtime PM callbacks from\\nbeing invoked) to wait for the .runtime_idle() callback to complete should\\nit be running at that point.  A suitable place for doing that is in\\npci_device_remove() which calls pm_runtime_get_sync() before removing the\\ndriver, so it may as well call pm_runtime_barrier() subsequently, which\\nwill prevent the race in question from occurring, not just in the rtsx_pcr\\ndriver, but in any PCI drivers providing .runtime_idle() callbacks.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.312\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.274\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.215\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.154\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.84\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.24\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.12\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.3\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"2.6.36\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:35:20.480Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35809\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:35:20.480Z\", \"dateReserved\": \"2024-05-17T12:19:12.342Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T13:23:16.168Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.