CVE-2024-27036

What it actually does

The cifs writeback code fails to call xas_reset() when a folio would overrun wsize, causing xas_pause() to advance past the page and skip writing it, plus mishandling of filemap_get_folios_tag() retries, resulting in silent data corruption on the remote share.

Why it matters to the business

Linux systems writing files to CIFS/SMB shares can produce corrupted copies without warning, forcing organizations to re-verify transfers, increasing operational overhead and risking undetected data loss in backups or shared storage.

How an attack unfolds

An attacker or automated process mounts a CIFS share with a constrained wsize, performs writes that cross the wsize boundary (such as copying a 64 KiB file), and the flawed xarray loop skips pages, leaving the remote file incomplete or altered while the local source remains intact.

How to fix it

Upgrade the Linux kernel to a version containing commit e45deec35bf7f1f4f992a707b2d04a8c162f2240; rebuild and reboot affected systems, or apply the backported stable patch if using a distribution kernel.

How to confirm the fix worked

Confirm the running kernel contains commit e45deec35bf7f1f4f992a707b2d04a8c162f2240; reproduce the provided test (dd 64 KiB random file, cp to CIFS mount with wsize=64000, cmp) and verify no mismatch occurs.

Typical attack path

1. Mount CIFS share with wsize set to 64000
2. Create or copy a file whose size triggers folio extension across the wsize limit
3. Kernel writeback loop calls xas_pause() without reset and skips the page
4. Remote file is written with missing or incorrect data at the boundary

How to detect it

Review kernel logs for cifs writeback warnings, compare file checksums after CIFS copies, and inspect xarray or folio handling in crash dumps; no distinct post-exploitation artifacts exist because the issue is a write logic flaw rather than an injected payload.

What your security team should do

• Prioritize kernel updates on all systems that mount CIFS shares
• Temporarily restrict wsize to smaller values or switch to NFS where feasible until patched
• Add post-transfer integrity checks for critical CIFS file copies
• Track EPSS and kernel changelog entries for related netfslib offload work