CVE-2024-36923: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36923 is a vulnerability in the Linux kernel's 9P filesystem implementation, discovered in May 2024. The issue occurs when an inode gets evicted after an iget failure, where the inode structure is only partially initialized, leading to references to uninitialized structures such as fscache cookies (NVD).

The vulnerability exists in the fs/9p/vfs_inode.c file of the Linux kernel. When an iget operation fails due to inability to retrieve information from the server, the inode structure remains partially initialized. During inode eviction, the system attempts to reference uninitialized structures, particularly fscache cookies. The issue has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a denial of service condition due to the system attempting to access uninitialized structures. This affects Linux kernel versions from 6.1 through 6.8.10, potentially causing system instability or crashes (NVD).

The vulnerability requires local access and low privileges to exploit. It was initially discovered and reported by the syzkaller automated testing system (syzbot+eb83fe1cce5833cd66a0@syzkaller.appspotmail.com) (Kernel Patch).

The vulnerability has been patched by adding a check for bad_inode before performing operations other than clearing the inode from the cache. The fix ensures that if the inode is bad, it only performs the clear_inode operation, preventing access to potentially uninitialized structures. The patch has been incorporated into various Linux kernel versions, including 6.1.119-1~deb11u1 for Debian systems (Debian Update).