CVE-2024-35836: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's DPLL (Digital Phase-Locked Loop) subsystem has been identified and tracked as CVE-2024-35836. The issue occurs when a kernel module is unbound while pin resources are not entirely freed, and the module is subsequently rebound. This vulnerability was discovered in May 2024 and affects the Linux kernel's DPLL framework (Kernel Git).

The vulnerability manifests when a kernel module is unbound but pin resources are not completely freed due to other kernel module instances of the same PCI device maintaining references to the pin. Upon rebinding the module, the pin properties remain unupdated since they are only assigned during pin memory allocation. The prop pointer continues to reference the deallocated kernel module memory from the unbind operation. This condition leads to a kernel crash when pin dump is invoked (Kernel Git).

When exploited, this vulnerability results in a kernel crash, affecting system stability and availability. The issue specifically impacts the DPLL subsystem's pin dump functionality when operating under specific module binding conditions (Kernel Git).

The vulnerability requires specific conditions to be exploited: a kernel module must be unbound with retained pin resources, then rebound, followed by a pin dump operation. This sequence of events leads to the kernel crash (Kernel Git).

The issue has been resolved by implementing persistent pin properties storage in the DPLL subsystem. The fix involves copying content from the kernel module when the pin is allocated, rather than using the kernel module's memory directly. This solution prevents the crash scenario by maintaining proper memory management (Kernel Git).