of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
In the Linux kernel, the following vulnerability has been resolved: of: dynamic: Synchronize of_changeset_destroy() with the devlink removals In the following sequence: 1) of_platform_depopulate() 2) of_overlay_remove() During the step 1, devices are destroyed and devlinks are removed. During the step 2, OF nodes are destroyed but __of_changeset_entry_destroy() can raise warnings related to missing of_node_put(): ERROR: memory leak, expected refcount 1 instead of 2 ... Indeed, during the devlink removals performed at step 1, the removal itself releasing the device (and the attached of_node) is done by a job queued in a workqueue and so, it is done asynchronously with respect to function calls. When the warning is present, of_node_put() will be called but wrongly too late from the workqueue job. In order to be sure that any ongoing devlink removals are done before the of_node destruction, synchronize the of_changeset_destroy() with the devlink removals.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.215, 5.15.154, 6.1.85, 6.6.26, 6.8.5
- CVEs
- CVE-2024-35879
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 21:50 UTC · Revision 1
Source evidence
of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
core-osv · Original sourcePublished 19 May 2024, 08:34 UTC
In the Linux kernel, the following vulnerability has been resolved: of: dynamic: Synchronize of_changeset_destroy() with the devlink removals In the following sequence: 1) of_platform_depopulate() 2) of_overlay_remove() During the step 1, devices are destroyed and devlinks are removed. During the step 2, OF nodes are destroyed but __of_changeset_entry_destroy() can raise warnings related to missing of_node_put(): ERROR: memory leak, expected refcount 1 instead of 2 ... Indeed, during the devlink removals performed at step 1, the removal itself releasing the device (and the attached of_node) is done by a job queued in a workqueue and so, it is done asynchronously with respect to function calls. When the warning is present, of_node_put() will be called but wrongly too late from the workqueue job. In order to be sure that any ongoing devlink removals are done before the of_node destruction, synchronize the of_changeset_destroy() with the devlink removals.
osv:CVE-2024-35879
Kernel
Fixed versions: 5.10.215, 5.15.154, 6.1.85, 6.6.26, 6.8.5
Complete source record
{
"id": "feeeb2344a39acfe2b3be0416f0aeeef9ad9e4c68f18d28d01c0587be6edfe7e",
"url": "https://osv.dev/vulnerability/CVE-2024-35879",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "of: dynamic: Synchronize of_changeset_destroy() with the devlink removals",
"summary": "In the Linux kernel, the following vulnerability has been resolved: of: dynamic: Synchronize of_changeset_destroy() with the devlink removals In the following sequence: 1) of_platform_depopulate() 2) of_overlay_remove() During the step 1, devices are destroyed and devlinks are removed. During the step 2, OF nodes are destroyed but __of_changeset_entry_destroy() can raise warnings related to missing of_node_put(): ERROR: memory leak, expected refcount 1 instead of 2 ... Indeed, during the devlink removals performed at step 1, the removal itself releasing the device (and the attached of_node) is done by a job queued in a workqueue and so, it is done asynchronously with respect to function calls. When the warning is present, of_node_put() will be called but wrongly too late from the workqueue job. In order to be sure that any ongoing devlink removals are done before the of_node destruction, synchronize the of_changeset_destroy() with the devlink removals.",
"evidence": "osv:CVE-2024-35879",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.215",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.154",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.85",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.26",
"evidence": "/affected/1/ranges"
},
{
"value": "6.8.5",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2024-35879",
"aliases": [
"CVE-2024-35879"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d007150b4e15bfcb8d36cfd88a5645d42e44d383"
},
{
"fixed": "3127b2ee50c424a96eb3559fbb7b43cf0b111c7a"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "80dd33cf72d1ab4f0af303f1fa242c6d6c8d328f"
},
{
"fixed": "3ee2424107546d882e1ddd75333ca9c32879908c"
},
{
"fixed": "7b6df050c45a1ea158fd50bc32a8e1447dd1e951"
},
{
"fixed": "801c8b8ec5bfb3519566dff16a5ecd48302fca82"
},
{
"fixed": "ae6d76e4f06c37a623e357e79d49b17411db6f5c"
},
{
"fixed": "8917e7385346bd6584890ed362985c219fe6ae84"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.42"
},
{
"fixed": "5.10.215"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.12.9"
},
{
"fixed": "5.13"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "252c23915546863685ecc68cb3a39e7e80c6c9d4"
}
]
}
],
"versions": [
"v5.10.214",
"v5.10.213",
"v5.10.212",
"v5.10.211",
"v5.10.210",
"v5.10.209",
"v5.10.208",
"v5.10.207",
"v5.10.206",
"v5.10.205",
"v5.10.204",
"v5.10.203",
"v5.10.202",
"v5.10.201",
"v5.10.200",
"v5.10.199",
"v5.10.198",
"v5.10.197",
"v5.10.196",
"v5.10.195",
"v5.10.194",
"v5.10.193",
"v5.10.192",
"v5.10.191",
"v5.10.190",
"v5.10.189",
"v5.10.188",
"v5.10.187",
"v5.10.186",
"v5.10.185",
"v5.10.184",
"v5.10.183",
"v5.10.182",
"v5.10.181",
"v5.10.180",
"v5.10.179",
"v5.10.178",
"v5.10.177",
"v5.10.176",
"v5.10.175",
"v5.10.174",
"v5.10.173",
"v5.10.172",
"v5.10.171",
"v5.10.170",
"v5.10.169",
"v5.10.168",
"v5.10.167",
"v5.10.166",
"v5.10.165",
"v5.10.164",
"v5.10.163",
"v5.10.162",
"v5.10.161",
"v5.10.160",
"v5.10.159",
"v5.10.158",
"v5.10.157",
"v5.10.156",
"v5.10.155",
"v5.10.154",
"v5.10.153",
"v5.10.152",
"v5.10.151",
"v5.10.150",
"v5.10.149",
"v5.10.148",
"v5.10.147",
"v5.10.146",
"v5.10.145",
"v5.10.144",
"v5.10.143",
"v5.10.142",
"v5.10.141",
"v5.10.140",
"v5.10.139",
"v5.10.138",
"v5.10.137",
"v5.10.136",
"v5.10.135",
"v5.10.134",
"v5.10.133",
"v5.10.132",
"v5.10.131",
"v5.10.130",
"v5.10.129",
"v5.10.128",
"v5.10.127",
"v5.10.126",
"v5.10.125",
"v5.10.124",
"v5.10.123",
"v5.10.122",
"v5.10.121",
"v5.10.120",
"v5.10.119",
"v5.10.118",
"v5.10.117",
"v5.10.116",
"v5.10.115",
"v5.10.114",
"v5.10.113",
"v5.10.112",
"v5.10.111",
"v5.10.110",
"v5.10.109",
"v5.10.108",
"v5.10.107",
"v5.10.106",
"v5.10.105",
"v5.10.104",
"v5.10.103",
"v5.10.102",
"v5.10.101",
"v5.10.100",
"v5.10.99",
"v5.10.98",
"v5.10.97",
"v5.10.96",
"v5.10.95",
"v5.10.94",
"v5.10.93",
"v5.10.92",
"v5.10.91",
"v5.10.90",
"v5.10.89",
"v5.10.88",
"v5.10.87",
"v5.10.86",
"v5.10.85",
"v5.10.84",
"v5.10.83",
"v5.10.82",
"v5.10.81",
"v5.10.80",
"v5.10.79",
"v5.10.78",
"v5.10.77",
"v5.10.76",
"v5.10.75",
"v5.10.74",
"v5.10.73",
"v5.10.72",
"v5.10.71",
"v5.10.70",
"v5.10.69",
"v5.10.68",
"v5.10.67",
"v5.10.66",
"v5.10.65",
"v5.10.64",
"v5.10.63",
"v5.10.62",
"v5.10.61",
"v5.10.60",
"v5.10.59",
"v5.10.58",
"v5.10.57",
"v5.10.56",
"v5.10.55",
"v5.10.54",
"v5.10.53",
"v5.10.52",
"v5.10.51",
"v5.10.50",
"v5.10.49",
"v5.10.48",
"v5.10.47",
"v5.10.46",
"v5.10.45",
"v5.10.44",
"v5.10.43",
"v5.10.42",
"v5.12.19",
"v5.12.18",
"v5.12.17",
"v5.12.16",
"v5.12.15",
"v5.12.14",
"v5.12.13",
"v5.12.12",
"v5.12.11",
"v5.12.10",
"v5.12.9"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35879.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.10.215"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.154"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.13.0"
},
{
"fixed": "6.1.85"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.6.26"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.8.5"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35879.json"
}
}
],
"modified": "2026-10-28T02:30:24.147605997Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/3127b2ee50c424a96eb3559fbb7b43cf0b111c7a",
"https://git.kernel.org/stable/c/3ee2424107546d882e1ddd75333ca9c32879908c",
"https://git.kernel.org/stable/c/7b6df050c45a1ea158fd50bc32a8e1447dd1e951",
"https://git.kernel.org/stable/c/801c8b8ec5bfb3519566dff16a5ecd48302fca82",
"https://git.kernel.org/stable/c/8917e7385346bd6584890ed362985c219fe6ae84",
"https://git.kernel.org/stable/c/ae6d76e4f06c37a623e357e79d49b17411db6f5c",
"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35879.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-35879",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35879.json"
}
},
"related_cves": [
{
"value": "CVE-2024-35879",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 490339,
"published_at": "2024-05-19T08:34:36.45+00:00"
}