CVE-2024-35859: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35859 is a vulnerability in the Linux kernel related to module reference leakage in the block device subsystem. The issue was discovered through code review and affects the bdev_open_by_dev error path. The vulnerability was disclosed on May 17, 2024, and specifically involves a condition where module references are not properly released when bdev_may_open() fails (NVD).

The vulnerability stems from a module reference handling issue in the Linux kernel's block device subsystem. When bdev_may_open() is called, a module reference is already grabbed, but it fails to release this reference if bdev_may_open() fails. This issue was introduced in commit ed5cc702d311 which added a configuration option to prevent writing to mounted devices. The fix involves modifying the error handling path in block/bdev.c to properly release the module reference by changing the error jump target from 'abort_claiming' to 'put_module' (Kernel Commit). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to module reference leakage in the Linux kernel, potentially causing resource management issues. The CVSS scoring indicates that while the vulnerability requires local access and low privileges, it could potentially lead to high availability impacts on the affected system (NVD).

The vulnerability requires local access and low privileges to exploit. It was discovered through code review rather than active exploitation, and there are no known instances of this vulnerability being exploited in the wild (NVD).

The vulnerability has been fixed in various Linux kernel versions. Ubuntu has released fixes in version 6.8.0-40.40 for 24.04 LTS (noble) and corresponding versions for other supported releases. The fix involves a one-line code change in block/bdev.c to correct the error handling path (Ubuntu Security).