CVE-2024-26840

What it actually does

Memory leak of cred structures allocated in cachefiles_determine_cache_security and never released because cachefiles_daemon_unbind omits the put and error paths in cachefiles_add_cache fail to release the reference.

Why it matters to the business

Repeated cache bind/unbind operations on systems using fscache with cachefiles gradually exhaust kernel memory, leading to performance degradation or denial of service; the issue affects any Linux distribution shipping the affected kernel versions and has been public for over two years.

How an attack unfolds

An attacker with local access writes to /dev/cachefiles to add a cache, triggers error paths or performs unbind operations via cachefilesd, causing unreleased cred objects to accumulate; repeated cycles exhaust memory without requiring special privileges beyond local access.

How to fix it

Upgrade the Linux kernel to the fixed commit cb5466783793e66272624cf71925ae1d1ba32083 or later; apply the stable backports that add the missing put_cred calls in cachefiles_daemon_unbind and the error path of cachefiles_add_cache.

How to confirm the fix worked

Confirm the running kernel contains commit cb5466783793e66272624cf71925ae1d1ba32083; after applying the fix, reproduce bind/unbind cycles and verify no unreferenced cred objects remain in kmemleak reports.

Typical attack path

1. Obtain local shell or process execution on target system
2. Interact with /dev/cachefiles to invoke cachefiles_add_cache
3. Force error branches or call cachefiles_daemon_unbind repeatedly
4. Observe gradual increase in unreferenced cred allocations until OOM

How to detect it

Review kernel logs for cachefilesd processes, enable kmemleak and search for unreferenced objects allocated via prepare_creds called from cachefiles_determine_cache_security, and correlate with cachefiles_daemon_write activity.

What your security team should do

• Prioritize kernel updates on all systems exposing /dev/cachefiles to users
• Monitor kmemleak or slabinfo for cred object growth correlated with cachefiles activity
• Restrict unprivileged access to cachefiles device nodes until patched