CVE-2024-35806: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35806 is a vulnerability in the Linux kernel affecting the soc/fsl/qbman component, discovered and disclosed on May 17, 2024. The vulnerability specifically affects the interrupt handling mechanism when taking cgr_lock in the kernel's qbman subsystem (NVD).

The vulnerability stems from improper interrupt handling in the Linux kernel's qbman subsystem. The issue occurs because smp_call_function_single disables IRQs when executing the callback, but IRQs were not consistently disabled when taking cgr_lock in other locations. This inconsistency could lead to potential deadlocks. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could result in a potential deadlock condition in the Linux kernel's qbman subsystem, which may lead to system availability issues. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, there is a high impact on system availability (NVD).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is required for exploitation, as indicated by the CVSS vector AV:L/AC:L/PR:L/UI:N (NVD).

The vulnerability has been fixed by modifying the code to consistently disable interrupts when taking cgr_lock. The fix has been implemented in various Linux kernel versions, including 5.10.216-1 for Debian systems. Users are advised to update their kernel to the patched versions (Debian LTS).