{"id":"CVE-2024-35985","summary":"sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf()\n\nIt was possible to have pick_eevdf() return NULL, which then causes a\nNULL-deref. This turned out to be due to entity_eligible() returning\nfalsely negative because of a s64 multiplcation overflow.\n\nSpecifically, reweight_eevdf() computes the vlag without considering\nthe limit placed upon vlag as update_entity_lag() does, and then the\nscaling multiplication (remember that weight is 20bit fixed point) can\noverflow. This then leads to the new vruntime being weird which then\ncauses the above entity_eligible() to go side-ways and claim nothing\nis eligible.\n\nThus limit the range of vlag accordingly.\n\nAll this was quite rare, but fatal when it does happen.","modified":"2026-03-20T12:36:46.593672Z","published":"2024-05-20T09:47:52.389Z","related":["MGASA-2024-0263","MGASA-2024-0266"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35985.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/06f27e6d7bf0abf54488259ef36bbf0e1fccb35c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1560d1f6eb6b398bddd80c16676776c0325fe5fe"},{"type":"WEB","url":"https://git.kernel.org/stable/c/470d347b14b0ecffa9b39cf8f644fa2351db3efb"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35985.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35985"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"14204acc09f652169baed1141c671429047b1313"},{"fixed":"470d347b14b0ecffa9b39cf8f644fa2351db3efb"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"eab03c23c2a162085b13200d7942fc5a00b5ccc8"},{"fixed":"06f27e6d7bf0abf54488259ef36bbf0e1fccb35c"},{"fixed":"1560d1f6eb6b398bddd80c16676776c0325fe5fe"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-35985.json"}}],"schema_version":"1.7.5"}