CVE-2024-35926: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability has been identified in the Linux kernel's crypto subsystem, specifically in the Intel IAA (Intel Analytics Accelerator) component. The vulnerability, tracked as CVE-2024-35926, was discovered and disclosed on May 19, 2024. The issue involves a descriptor leak in the disable_async paths of iaa_compress/decompress() functions, where IDXD descriptors are not properly freed in the async_disable case (Kernel Git).

The vulnerability exists in the Linux kernel's crypto subsystem, specifically affecting the IAA (Intel Analytics Accelerator) driver. The technical issue involves the disable_async paths of iaa_compress/decompress() functions failing to free IDXD descriptors in the async_disable case. This condition primarily manifests in test cases where req->dst is set to null. The fix involves adding a condition to free descriptors in these paths by modifying the logic to include the disable_async case in the descriptor freeing check (Kernel Git).

The impact of this vulnerability appears to be limited to resource leakage in specific test case scenarios where req->dst is set to null. While resource leaks can potentially lead to system degradation over time, the specific impact in this case appears to be contained to test environments (Kernel Git).

The vulnerability has been patched in the Linux kernel. The fix involves modifying the condition for freeing descriptors to include both non-async mode and disable_async cases. The patch has been implemented and merged into the kernel codebase (Kernel Git, Kernel Stable).