CVE-2024-26612

What it actually does

Improper order of operations in fscache_put_cache() causes dereference of a cache pointer before an IS_ERR_OR_NULL check, allowing invalid pointer access that results in a kernel oops or memory corruption.

Why it matters to the business

Linux systems using fscache for network filesystem caching may experience sudden kernel crashes or instability, leading to service interruptions and potential data loss in affected environments.

How an attack unfolds

An attacker with local access crafts filesystem operations that place fscache into an error state and then triggers fscache_put_cache, causing the kernel to dereference an invalid pointer and crash the system.

How to fix it

Upgrade affected Linux packages to fixed versions: Debian 12/13 to 6.1.7-1 or apply kernel commit 7ac9578e45b20e3f3c0c8eb71f5417a499a7226a; reboot after update.

How to confirm the fix worked

Verify running kernel version is at or above the fixed release, inspect source for the reordered IS_ERR_OR_NULL check before dereference, and confirm absence of related oops reports after patching.

Typical attack path

1. Gain local access on a Linux system using fscache
2. Perform netfs operations that lead to an error cache object
3. Invoke code paths calling fscache_put_cache with the invalid pointer
4. Trigger kernel oops and potential system denial of service

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing fscache_put_cache or invalid cache pointer dereferences; correlate with netfs activity timestamps.

• fscache_put_cache
• Unable to handle kernel NULL pointer dereference
• Oops in fscache

What your security team should do

• Prioritize kernel package updates on all affected Linux hosts within standard change windows
• Enable automatic security updates for kernel packages where feasible
• Monitor system logs for fscache-related oops entries until patches are deployed