CVE-2024-26630

What it actually does

The vulnerability is a use-after-free in the cachestat implementation where folios are accessed from the page cache xarray without holding references, allowing concurrent release and reuse as another folio, page, or slab object.

Why it matters to the business

Local attackers can trigger kernel instability, crashes, or potential code execution on unpatched Linux systems, disrupting operations and requiring urgent patching across server and endpoint fleets.

How an attack unfolds

An attacker invokes the cachestat syscall on files whose page cache entries can be concurrently reclaimed (for example via memory pressure or tmpfs swap), causing the kernel to read from a freed folio structure for offset, dirty, and writeback state.

How to fix it

Upgrade the Linux kernel to the commit ba60fdf75e89ea762bb617be578dc47f27655117 or any later stable release that incorporates the xarray-based lookup fix.

How to confirm the fix worked

Confirm the running kernel contains commit ba60fdf75e89ea762bb617be578dc47f27655117; additionally verify that cachestat on tmpfs files now consistently reports zero dirty and writeback counters.

Typical attack path

1. Obtain local execution on an affected Linux system
2. Identify or create files whose page cache folios are subject to reclamation
3. Trigger concurrent folio release while invoking cachestat
4. Leverage the resulting use-after-free for denial of service or privilege escalation

How to detect it

Review kernel logs and audit trails for cachestat-related oops, warnings, or use-after-free reports; correlate with processes invoking the cachestat syscall under memory pressure.

What your security team should do

• Apply the referenced kernel commit or distribution update to all affected hosts without delay
• Harden local access controls and consider disabling unprivileged cachestat use where feasible
• Monitor kernel logs for oops or warnings referencing cachestat or folio operations