CVE-2024-26973

What it actually does

The flaw leaves the final two bytes of a 12-byte nostale file handle uninitialized when fat_encode_fh_nostale() is called without a parent directory, allowing uninitialized kernel stack data to be copied to userspace.

Why it matters to the business

Local users on affected Linux systems may obtain small fragments of kernel memory, which could aid reconnaissance or follow-on attacks; the issue affects many distributions using the FAT driver but has low exploitability.

How an attack unfolds

An attacker with a local account invokes the file-handle encoding path for FAT volumes without supplying a parent inode, receives the partially uninitialized handle, and inspects the trailing bytes for kernel memory contents.

How to fix it

Upgrade the Linux kernel to a version containing commit 9840d1897e28f8733cc1e38f97e044f987dc0a63 or apply the equivalent stable backport that properly initializes the full 12-byte handle.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or later; test by encoding a nostale file handle without a parent and verifying that the entire handle is zero-initialized before the length field.

Typical attack path

1. Obtain local shell or process execution on a Linux system using the FAT driver
2. Trigger fat_encode_fh_nostale() for a file without supplying a parent directory reference
3. Read the returned file handle and examine the final two bytes for leaked kernel data

How to detect it

Search system call logs or audit trails for repeated fat file-handle encoding operations on systems that have not yet been patched; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on all systems exposing FAT file systems to untrusted local users
• Review and restrict local access where kernel updates cannot be applied promptly
• Monitor vendor advisories for distribution-specific packages that include the fix