CVE-2024-35879: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35879 affects the Linux kernel's device tree and open firmware driver. The vulnerability was discovered in a sequence involving of_platform_depopulate() and of_overlay_remove() operations, where a race condition in device link removal could lead to memory leak warnings (Kernel Git).

During device destruction and devlink removal (step 1), followed by OF nodes destruction (step 2), the __of_changeset_entry_destroy() function raises warnings about missing of_node_put() calls, indicating a reference count mismatch. This occurs because the device and attached of_node release during devlink removal is queued asynchronously in a workqueue, causing the of_node_put() to be called too late from the workqueue job (Kernel Git).

The vulnerability results in memory leak warnings and potential memory management issues in the Linux kernel when handling device tree operations (NVD).

The issue requires specific timing conditions during device tree operations and primarily affects system stability rather than presenting direct security exploitation vectors (NVD).

The vulnerability has been patched by synchronizing of_changeset_destroy() with devlink removals using device_link_wait_removal() to ensure all pending device links are deleted before freeing device nodes. This fix has been incorporated into various Linux kernel versions (Ubuntu Security).