CVE-2024-36947

What it actually does

Reference counting imbalance in qibfs dentry handling allows simple_recursive_removal to drop pinning references without a corresponding dput for dentries obtained via dcache lookup, resulting in leaked dentry structures.

Why it matters to the business

Long-running systems may experience gradual memory exhaustion and degraded stability in environments relying on the affected filesystem code, increasing operational overhead for maintenance and potential unplanned downtime.

How an attack unfolds

An attacker with local access triggers repeated filesystem operations involving dcache lookups on qibfs that invoke simple_recursive_removal, accumulating unreleased dentry references without any remote or authenticated exploitation path demonstrated.

How to fix it

Update to a kernel version containing the fix that adds the required dput call after dcache lookup in the qibfs simple_recursive_removal path.

How to confirm the fix worked

Confirm the presence of the balancing dput call in the qibfs code path and monitor dentry cache statistics for stabilization after applying the update.

Typical attack path

1. Obtain local access to a system mounting qibfs
2. Perform sequences of directory and file operations that exercise dcache lookup followed by recursive removal
3. Repeat to accumulate leaked dentries over time

How to detect it

Inspect kernel logs and memory statistics for unexpected dentry growth patterns after filesystem operations; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on systems using qibfs or InfiniBand-related filesystems
• Review and restrict local access where qibfs is mounted
• Monitor memory usage trends on affected hosts