CVE-2024-26878

What it actually does

Race condition between dquot_free_inode (and similar routines) and quota_off allows a NULL inode quota pointer to be dereferenced after it is cleared, triggering a kernel NULL pointer dereference.

Why it matters to the business

Local denial-of-service risk on Linux systems using disk quotas; successful exploitation can crash the kernel, requiring reboot and causing service interruption. Low exploitability reduces urgency but patching remains necessary on affected kernels.

How an attack unfolds

An attacker with local access triggers concurrent quota operations: one thread performs quota accounting while another disables quotas, winning the race to clear the pointer and causing the first thread to dereference NULL.

How to fix it

Upgrade the Linux kernel to a version containing the fix (for example linux 3.11.0-12.19 or linux-aws-5.15 5.15.0-1072.78~20.04.1 or later releases that backport the temporary-pointer change in quota code). Reboot after installing the updated kernel package.

How to confirm the fix worked

Verify the running kernel version is at or above the fixed release; inspect source for the temporary-pointer guard around i_dquot access in dquot_free_inode and related functions; confirm no NULL dereference paths remain under concurrent quota-off.

Typical attack path

1. Obtain local shell or process execution on target system
2. Mount or access a filesystem with quotas enabled
3. Concurrently invoke quota-off and inode quota operations to win the described race
4. Trigger NULL pointer dereference resulting in kernel oops or panic

How to detect it

Search kernel logs and crash dumps for NULL pointer dereference oops with stack traces containing dquot_free_inode, quota_off, remove_dquot_ref or i_dquot; correlate timestamps with processes performing quota administrative operations.

• dquot_free_inode.*NULL
• quota_off.*remove_dquot_ref
• BUG: unable to handle kernel NULL pointer dereference.*dquot

What your security team should do

• Prioritize kernel updates on all systems that enable disk quotas
• Apply the fix during the next maintenance window and reboot
• Review systems for unnecessary quota usage and disable where possible to reduce attack surface
• Monitor kernel logs for quota-related NULL pointer oops until patches are deployed