CVE-2024-36966

What it actually does

In the Linux kernel EROFS filesystem, erofs_kill_sb() incorrectly assumes fscache mode when s_bdev is uninitialized under CONFIG_EROFS_FS_ONDEMAND, resulting in an ida_free call on an unallocated ID and a kernel warning.

Why it matters to the business

Mount operations on EROFS block devices may trigger kernel warnings and reduce system stability on affected kernels, with low overall risk due to absence from known exploited lists and minimal exploit probability.

How an attack unfolds

An attacker would need to trigger mount of an EROFS filesystem in block-device mode on a vulnerable kernel with the on-demand config enabled; the code path leads only to a warning rather than memory corruption or code execution, and no threat actors or campaigns have been associated with this issue.

How to fix it

Upgrade the Linux kernel to the fixed commit f9b877a7ee312ec8ce17598a7ef85cb820d7c371 or later; for Debian packages apply the listed gtkwave updates where they correspond to kernel backports (3.3.118-0.1~deb12u1 and equivalents) and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit f9b877a7ee312ec8ce17598a7ef85cb820d7c371, verify EROFS mount operations no longer produce the ida_free warning, and check /proc/config.gz or kernel build logs for the CONFIG_EROFS_FS_ONDEMAND setting.

Typical attack path

1. Identify a system running a vulnerable Linux kernel with EROFS support and CONFIG_EROFS_FS_ONDEMAND enabled
2. Cause or wait for erofs_kill_sb to be invoked during mount of a block-device-based EROFS volume before s_bdev initialization
3. Observe the ida_free warning in kernel logs

How to detect it

Search kernel logs for the exact warning string 'ida_free called for id=0 which is not allocated' combined with erofs_kill_sb in the call trace; no widespread exploitation artifacts are known.

What your security team should do

• Prioritize kernel upgrades on any systems using EROFS block-device mounts within the next maintenance window
• Review kernel configuration to determine if CONFIG_EROFS_FS_ONDEMAND is enabled and disable if EROFS on-demand features are unused
• Monitor kernel logs for ida_free warnings during EROFS mount attempts until patches are deployed