CVE-2024-35975: 
Linux Kernel vulnerability analysis and mitigation

A resource leak vulnerability was discovered in the Linux kernel's octeontx2-pf driver, identified as CVE-2024-35975. The issue affects Linux kernel versions from 6.6 up to (excluding) 6.6.28, versions from 6.7 up to (excluding) 6.8.7, and release candidates 6.9-rc1 through 6.9-rc3. The vulnerability was disclosed on May 20, 2024, and involves a failure to properly free transmit scheduler resources after class deletion (NVD).

The vulnerability stems from a bug in the Round Robin scheduling support implementation where the Netdev driver allocates transmit schedulers upon class creation but fails to free these resources after class deletion. The issue specifically affects the octeontx2-pf driver's quality of service (QoS) functionality. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The resource leak can lead to a gradual depletion of system resources, potentially resulting in degraded performance or denial of service conditions in affected systems. The vulnerability specifically affects the network traffic scheduling capabilities of systems using the octeontx2-pf driver (NVD).

The vulnerability requires local access with privileged permissions to exploit. There are no known reports of this vulnerability being exploited in the wild (NVD).

The vulnerability has been patched in the Linux kernel. The fix involves properly marking scheduler index usage in the driver's resource tracking system. Updates are available in various Linux distributions, including Ubuntu 24.04 LTS (linux-aws 6.8.0-1011.12, linux-azure 6.8.0-1010.10) and other affected versions (Ubuntu Security).