What is CVE-2024-35974?

CVE-2024-35974 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, affecting Linux kernel versions from 6.1.16 onward and patched in 6.1.17, 6.2.4, 6.6.28 and others. CVE-2024-35974 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2024-35974?

CVE-2024-35974 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2024-35974?

Yes, CVE-2024-35974 has been patched. Fixed versions include 6.1.17, 6.2.4, 6.6.28 and others. If you are running Linux kernel 6.1.16 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2024-35974 actively exploited?

CVE-2024-35974 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2024-35974

Medium

In the Linux kernel, the following vulnerability has been resolved: block: fix q->blkg_list corruption during disk rebind Multiple gendisk instances can allocated/added for single request queue in case of disk rebind. blkg may still stay in q->blkg_list when calling blkcg_init_disk() for rebind, then q->blkg_list becomes corrupted. Fix the list corruption issue by: - add blkg_init_queue() to initialize q->blkg_list & q->blkcg_mutex only - move calling blkg_init_queue() into blk_alloc_queue() The list corruption should be started since commit f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()") which delays removing blkg from q->blkg_list into blkg_free_workfn().

Package Linux Kernel

Published 2024-05-20

Last modified 2025-12-23

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 6.1.16, 6.2.3, 5.18 and later are affected. Fixed in 6.1.17, 6.2.4, 6.6.28, 6.8.7, 6.9 and their respective stable series.

Affected from

≥ 6.1.16 ≥ 6.2.3 ≥ 5.18

Fixed in

✓ 6.1.17 6.1.x ✓ 6.2.4 6.2.x ✓ 6.6.28 6.6.x ✓ 6.8.7 6.8.x ✓ 6.9

References

5 total

Kernel Git
https://git.kernel.org/stable/c/740ffad95ca8033bd6e080ed337655b13b4d38ac

Patch
Kernel Git
https://git.kernel.org/stable/c/858c489d81d659af17a4d11cfaad2afb42e47a76

Patch
Kernel Git
https://git.kernel.org/stable/c/8b8ace080319a866f5dfe9da8e665ae51d971c54

Patch
Kernel Git
https://git.kernel.org/stable/c/083b58373463a6e5ee60ecb135269348f68ad7df
Kernel Git
https://git.kernel.org/stable/c/b5dae1cd0d8368b4338430ff93403df67f0b8bcc

Details

CVE ID CVE-2024-35974

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2024-05-20

Modified 2025-12-23

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2024-35974?

CVE-2024-35974 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 6.1.16 onward and has been patched in 6.1.17, 6.2.4, 6.6.28 and others. CVE-2024-35974 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2024-35974?

CVE-2024-35974 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2024-35974?

Yes. CVE-2024-35974 has been patched. Fixed versions include 6.1.17, 6.2.4, 6.6.28 and others. If you are running Linux kernel 6.1.16 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2024-35974 actively exploited?

No. CVE-2024-35974 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.