CVE-2024-35821: Linux Kernel Page Cache Data Race Vulnerability

CVE-2024-35821 Overview

CVE-2024-35821 is a race condition in the Linux kernel's UBIFS (Unsorted Block Image File System) implementation. The flaw stems from setting a freshly allocated page as uptodate before writing the intended data into it. Because page cache reads are lockless, a concurrent reader can observe stale or uninitialized data from that page. The issue affects the Linux kernel and Debian Linux distributions that ship vulnerable versions. Exploitation requires local access and low privileges, and the primary impact is to availability and data integrity of UBIFS-backed storage.

Critical Impact
A local, low-privileged user performing concurrent reads and writes against a UBIFS file system can observe uninitialized page cache contents and trigger availability failures on the affected system.

Affected Products

Linux kernel (multiple stable branches prior to the patches referenced in the kernel.org commits)
Debian Linux 10
Debian LTS kernel packages addressed in DLA announcements #17 and #20 (June 2024)

Discovery Timeline

2024-05-17 - CVE-2024-35821 published to the National Vulnerability Database (NVD)
2024-06 - Debian LTS releases advisories referencing the UBIFS fix
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35821

Vulnerability Analysis

The vulnerability is a race condition ([CWE-772] related handling) in the UBIFS write path. When UBIFS allocates a new page in the page cache to service a write, the previous implementation marked the page uptodate before the caller had copied the intended data into it. Page cache reads in Linux run without holding a per-page lock in the fast path, so another thread reading the same file offset can see the page marked valid and return whatever bytes currently reside in it. This produces stale reads and can crash callers that rely on data consistency, mapping to the reported availability impact.

Root Cause

The root cause is incorrect ordering of the SetPageUptodate call inside the UBIFS write-begin path. Marking the page valid before it has been populated violates the invariant that lockless readers depend on. The upstream fix moves SetPageUptodate into ubifs_write_end(), ensuring the flag is set only after the new data has been copied into the page.

Attack Vector

A local user with permission to read and write files on a UBIFS-mounted volume can trigger the race by issuing concurrent writes and reads against the same file. The attack requires no user interaction and no network access. The consequence is disclosure of uninitialized page contents to the reading thread and, under load, kernel-side failures that degrade system availability. There are no public proof-of-concept exploits and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available. Refer to the upstream commits such as 142d87c958d9454c3cffa625fab56f3016e8f9f3 and f19b1023a3758f40791ec166038d6411c8894ae3 on kernel.org for the exact patch content.

Detection Methods for CVE-2024-35821

Indicators of Compromise

Unexpected kernel warnings or oops entries referencing ubifs_write_begin, ubifs_write_end, or SetPageUptodate in dmesg output.
Application-level integrity errors (checksum mismatches, truncated reads) on files stored in UBIFS volumes under concurrent I/O.
Sporadic file corruption reports on embedded or flash-based Linux systems using UBIFS.

Detection Strategies

Inventory hosts running Linux kernel versions that predate the fix commits listed in the kernel.org references and identify those mounting UBIFS file systems.
Correlate kernel log anomalies with workloads that perform overlapping read and write operations on the same UBIFS files.
Track package versions on Debian systems against the fixed versions announced in Debian LTS advisories DLA-17 and DLA-20 (June 2024).

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a central log platform and alert on UBIFS subsystem errors.
Monitor file integrity on UBIFS-backed data paths using periodic hashing to catch stale-read symptoms.
Track kernel package versions across managed fleets and flag hosts that remain on pre-patch kernels.

How to Mitigate CVE-2024-35821

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that includes the UBIFS SetPageUptodate reordering fix.
On Debian 10 systems, install the kernel updates referenced in Debian LTS announcements DLA-17 and DLA-20 (June 2024) and reboot.
Restrict local access to systems that mount UBIFS volumes until patches are deployed.

Patch Information

The upstream fix moves SetPageUptodate into ubifs_write_end() so the page is only marked valid after new data has been written. The fix is present across multiple stable branches through commits 142d87c9, 17772bbe, 4aa55483, 4b7c4fc6, 723012ca, 778c6ad4, 8f599ab6, f19b1023, and fc99f4e2 on git.kernel.org. Debian users should consult the Debian LTS Announcement #17 and Debian LTS Announcement #20.

Workarounds

Where feasible, avoid workloads that perform simultaneous reads and writes against the same UBIFS file until the kernel is updated.
Consider migrating affected data off UBIFS to an alternate file system on non-flash storage as a temporary measure.
Limit which local accounts can access UBIFS mount points via standard POSIX permissions and mount options.

bash

# Verify installed kernel version and update on Debian-based systems
uname -r
apt-get update && apt-get install --only-upgrade linux-image-$(uname -r | sed 's/[^-]*-[^-]*-//')
systemctl reboot