CVE-2024-35979 is a use-after-free vulnerability identified in the Linux kernel's RAID1 implementation, specifically within the raid1_write_request() function. RAID1 is a common disk mirroring technology used to provide redundancy by writing identical data to multiple disks. The vulnerability arises due to improper handling of bio structures, which represent block I/O operations in the kernel. In the affected code, the r1_bio->bios[] array temporarily holds the original bio pointer during the write request process. If a blocked RAID device (rdev) is detected, the function free_r1bio() is called, which frees all bios in r1_bio->bios[], including the original bio that was not yet allocated for underlying disks. This premature freeing leads to a use-after-free condition, where the kernel attempts to access memory that has already been freed, causing potential kernel crashes (BUG bio-264) and undefined behavior. The vulnerability was demonstrated using mdadm to create a RAID1 array and fio to generate write I/O, combined with blocking one of the RAID devices via sysfs, triggering the bug. The root cause is that the bios for underlying disks are not allocated yet when free_r1bio() is called, and the fix involves directly using mempool_free() to free the r1_bio structure safely without freeing the original bio prematurely. This flaw can lead to kernel panics or memory corruption, impacting system stability and potentially allowing attackers to cause denial of service or escalate privileges if exploited in conjunction with other vulnerabilities. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a significant risk primarily to servers and systems running Linux kernels with RAID1 configurations, especially in data centers, cloud infrastructure, and enterprise storage solutions. The use-after-free can cause kernel crashes leading to denial of service, disrupting critical services and operations. In environments where RAID1 is used for redundancy and high availability, such instability can result in data unavailability and operational downtime. While direct exploitation for privilege escalation is not confirmed, the instability could be leveraged by attackers to cause persistent denial of service or combined with other vulnerabilities for more severe attacks. Organizations relying on Linux-based storage servers, virtualization hosts, or container platforms that utilize RAID1 are particularly at risk. The impact extends to sectors such as finance, healthcare, telecommunications, and government services across Europe, where data integrity and availability are paramount. Additionally, the complexity of the bug means that it could be triggered unintentionally by legitimate workloads, causing unexpected outages.

European organizations should prioritize updating their Linux kernel to the patched versions that address CVE-2024-35979 as soon as they become available. Until patches are applied, administrators should avoid using RAID1 configurations with blocked or faulty devices that could trigger this vulnerability. Monitoring RAID device states and avoiding manual blocking of devices in production environments can reduce risk. Implementing kernel crash dump analysis and proactive monitoring of system logs for signs of bio-related kernel errors can help detect attempts to exploit or trigger the vulnerability. For critical systems, consider temporarily migrating data off RAID1 arrays or using alternative RAID levels that do not involve the affected code path. Additionally, organizations should review their incident response plans to handle potential denial of service scenarios caused by kernel panics. Engaging with Linux distribution vendors for backported patches and security advisories is recommended to ensure timely remediation. Finally, testing updates in staging environments before deployment will help prevent unexpected disruptions.