CVE-2024-27389

What it actually does

The flaw is a reference-counting error in pstorefs inode handling: unloading a modular pstore backend while records remain in pstorefs performs an incorrect d_drop()/dput() sequence instead of d_invalidate(), triggering a double dput and the dcache warning at fs/dcache.c:762.

Why it matters to the business

On affected Linux systems, administrators may observe kernel warnings and possible instability when unloading pstore backends; the low EPSS and lack of KEV listing indicate limited real-world exploitation risk, but widespread kernel use means many distributions and embedded devices could encounter the issue until patched.

How an attack unfolds

An attacker with local access loads or populates pstore records, then unloads the modular pstore backend; the erroneous dput sequence fires the warning and can corrupt dentry reference counts, though no public exploit code or named threat-actor campaigns are associated with this CVE.

How to fix it

Upgrade the Linux kernel to commit db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e or later; Debian users should install the fixed erlang packages 1:14.b.3-dfsg-1 (or newer) that incorporate the corrected kernel code.

How to confirm the fix worked

Verify the running kernel contains commit db6e5e16f1ee9e3b01d2f71c7f0ba945f4bf0f4e; attempt to unload a pstore backend with records present and confirm the dput warning no longer appears in dmesg.

Typical attack path

1. Obtain local shell or module-loading privileges
2. Ensure pstore records exist in pstorefs
3. Unload the modular pstore backend driver
4. Trigger the dput double-drop path in dcache

How to detect it

Search kernel logs and dmesg for the exact warning string referencing dput.part.0+0x3f3/0x410 and fs/dcache.c:762; correlate with module unload events involving pstore.

• WARNING: CPU: .* PID: .* at fs/dcache.c:762 dput.part.0+0x3f3/0x410
• dput.part.0+0x3f3/0x410

What your security team should do

• Prioritize kernel updates on systems that use modular pstore backends
• Monitor dmesg and kernel logs for the dput.part.0 warning until patches are deployed
• Disable unnecessary pstore modular backends where feasible