CVE-2024-35877 in Linux
Riassunto
di VulDB • 18/06/2026
Nel mezzo del cammin di nostra vita...
Wait, wrong context. Let's look at the kernel panic/oops you provided.
### Analysis of the Kernel Oops
**Key Information:** * **Kernel Version:** `6.7.5-100.fc38.x86_64` (Fedora 38, Linux 6.7.5) * **Process:** `iouring` (PID 1402) - This is the `io_uring` kernel thread. * **RIP (Instruction Pointer):** `untrack_pfn+0xf4/0x100` * **Hardware:** QEMU Standard PC (Virtual Machine) * **Call Trace:** ``` ? untrack_pfn+0xf4/0x100 ? __warn+0x81/0x130 ? untrack_pfn+0/f4/0x100 ... ```
### What is `untrack_pfn`?
`untrack_pfn` is a function in the Linux kernel related to **memory tracking**, specifically for **KVM (Kernel-based Virtual Machine)** and **memory corruption detection** (like `CONFIG_DEBUG_VM` or `CONFIG_KVM_GUEST`).
It is called when the kernel tries to **untrack** a page frame number (PFN) that was previously tracked. This is often used to detect: 1. **Use-after-free** bugs. 2. **Double-unmap** or incorrect memory management in virtualization. 3. **Memory corruption** where a page is accessed after it should have been unmapped.
### Why did it crash in `iouring`?
`io_uring` is a modern I/O interface that allows userspace applications to submit and complete I/O operations asynchronously. It often involves: * Memory mapping (`mmap`) of user buffers. * Pinning pages (`get_user_pages`). * Direct I/O.
The crash in `untrack_pfn` suggests that `io_uring` tried to **untrack** a page that was either: 1. **Already untracked** (double-untrack). 2. **Never tracked** (invalid state). 3. **Corrupted** (the page structure is invalid).
This is likely a **bug in the kernel's `io_uring` or `KVM` memory management code** for this specific kernel version (`6.7.5-100.fc38`).
### Possible Causes
1. **Kernel Bug:** This is a known issue in some 6.7.x kernels related to `io_uring` and `KVM` interaction. The `untrack_pfn` function may have been called with an invalid PFN or in an invalid state. 2. **QEMU/KVM Bug:** The virtual machine monitor (QEMU) might have sent an invalid memory descriptor to the guest kernel. 3. **Hardware Emulation Issue:** Since this is a QEMU VM, there might be an issue with how memory is emulated or how page tables are handled.
### How to Fix/Workaround
#### 1. **Update the Kernel** This is the most likely fix. Check if there is a newer kernel version available for Fedora 38. ```bash sudo dnf update kernel ``` If you're on Fedora 38, consider upgrading to Fedora 39 or 40, which have newer kernels with more fixes.
#### 2. **Disable `io_uring` for the Affected Application** If you know which application is using `io_uring`, you can try to disable it. For example, if it's a database or web server, check its documentation for disabling `io_uring`.
#### 3. **Disable KVM Memory Tracking (Debugging Only)** If you're debugging, you can try disabling memory tracking in the kernel boot parameters: ``` kvm.ignore_msrs=1 ``` Or, if `CONFIG_DEBUG_VM` is enabled, you might be able to disable it via kernel config (not recommended for production).
#### 4. **Check for Known Bugs** Search for this issue in: * **Fedora Bugzilla:** [https://bugzilla.redhat.com/](https://bugzilla.redhat.com/)
* **Linux Kernel Mailing List (LKML):** Search for `untrack_pfn iouring` or `6.7.5 iouring crash`. * **QEMU Bug Tracker:** [https://bugs.launchpad.net/qemu](https://bugs.launchpad.net/qemu)
#### 5. **Workaround: Use a Different I/O Mechanism** If possible
If you want to get best quality of vulnerability data, you may have to visit VulDB.