CVE-2024-35879

A flaw was found in the Linux kernel's Open Firmware (OF) dynamic changeset subsystem. A race condition occurs during device tree overlay removal because background cleanup tasks are not synchronized before changeset destruction. A local user could trigger this flaw to cause reference count discrepancies, leading to memory leaks and a potential Denial of Service (DoS) through system instability.

This vulnerability is evaluated as having a Low impact because dynamic Open Firmware device tree manipulation requires administrative privileges and is not utilized in standard enterprise server installations. The synchronization failure happens during the asynchronous removal of device link structures when unloading dynamic device tree fragments, leading to internal reference count warnings rather than direct remote compromise or unprivileged privilege escalation. As typical enterprise systems do not dynamically alter device tree nodes, standard production environments are not exposed under default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.