CVE-2024-36001

What it actually does

Race condition in netfs_perform_write when performing writethrough I/O at or past EOF on a partial folio, where concurrent writeback operations both attempt to clear the writeback mark, triggering a kernel warning in netfs_writeback_lookup_folio.

Why it matters to the business

Kernel warnings, potential system instability, and degraded reliability for buffered file writes using O_SYNC, RWF_SYNC, or NETFS_ICTX_WRITETHROUGH on affected Linux kernels; high ecosystem prevalence increases operational risk for servers and devices running unpatched kernels.

How an attack unfolds

An attacker with local access crafts a sequence of buffered writes at or above EOF on a file opened with sync semantics; the missing flush-and-wait allows two writers to race on the same folio, hitting the writeback assertion in the collection worker.

How to fix it

Upgrade to Linux kernel 6.8.9 or later, or apply the fix from commit 5eaf23b2e81349f6614f88396dc468fda89fc0b9; rebuild and reboot with the patched kernel; for distributions without immediate packages, apply the backported patch or disable writethrough caching where feasible.

How to confirm the fix worked

Confirm the running kernel version is at least 6.8.9; inspect fs/netfs/write_collect.c around line 105 for the unconditional flush-and-wait logic; attempt to reproduce the original write pattern and verify absence of the 'folio is not under writeback' warning.

Typical attack path

1. Obtain local unprivileged access on an affected Linux system
2. Open a file at or near EOF with O_SYNC or equivalent writethrough flags
3. Issue concurrent or rapidly sequenced buffered writes that overlap a partial folio
4. Trigger the netfs_write_collection_worker to process the racing writebacks
5. Observe kernel warning or potential follow-on instability

How to detect it

Search kernel logs and dmesg for 'folio is not under writeback' or 'netfs_writeback_lookup_folio' warnings; correlate with processes performing O_SYNC writes near EOF on netfs filesystems; review audit logs for unusual write patterns on affected kernels.

• R=00000012: folio .* is not under writeback
• WARNING: .* at fs/netfs/write_collect.c:105
• Workqueue: events_unbound netfs_write_collection_worker

What your security team should do

• Prioritize patching production systems within the next maintenance window due to widespread kernel exposure
• Monitor kernel logs for netfs_writeback_lookup_folio warnings as an indicator of exposure
• Test patched kernels in staging environments with sync-heavy workloads before broad rollout
• Consider temporary mitigation by avoiding O_SYNC/RWF_SYNC on netfs-backed filesystems until upgraded