CVE-2024-35988: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35988 affects the Linux kernel's RISC-V architecture implementation. The vulnerability was discovered in May 2024 and involves an incorrect definition of TASK_SIZE on 64-bit NOMMU systems. On NOMMU systems, userspace memory can come from anywhere in physical RAM, and the current definition of TASK_SIZE was incorrect if any RAM exists above 4G, causing spurious failures in the userspace access routines (Kernel Git).

The vulnerability stems from an incorrect definition of TASK_SIZE in the RISC-V architecture's memory management code. The original implementation defined TASK_SIZE as 0xffffffffUL, which was insufficient for systems with RAM above 4GB. The fix changes this to _AC(-1, UL) to properly handle the full address space (Kernel Git).

The vulnerability can cause spurious failures in userspace access routines when running on RISC-V 64-bit systems with NOMMU configuration and RAM existing above 4GB (NVD).

The vulnerability requires a specific hardware configuration (RISC-V 64-bit with NOMMU) and the presence of RAM above 4GB to be exploitable. No active exploits have been reported in the wild (Ubuntu).

The issue has been fixed in multiple Linux kernel versions. Ubuntu has released patches for various kernel versions including 6.8.0-40.40 for 24.04 LTS and 5.15.0-116.126 for 22.04 LTS. The fix involves updating the TASK_SIZE definition in the kernel source code (Ubuntu).