CVE-2024-37078

What it actually does

The flaw causes a kernel BUG in __folio_start_writeback when nilfs2's log writer starts writeback for segment summary or super root blocks on the backing device's page cache without waiting for ongoing writebacks, leaving an inconsistent writeback state.

Why it matters to the business

Systems running Linux with the nilfs2 filesystem mounted may suffer unexpected kernel crashes or panics during direct destructive writes to the block device, resulting in downtime or potential data corruption. Low urgency applies given the absence of known exploitation or ransomware use.

How an attack unfolds

An attacker with the ability to issue direct writes to the underlying block device while nilfs2 is mounted triggers the race in the segment constructor thread; the missing wait allows the inconsistent state that hits the page-writeback BUG.

How to fix it

Update the Linux kernel to a version containing commit 95f6f81e50d858a7c9aa7c795ec14a0ac3819118, which adds the required wait for ongoing writebacks before setting the writeback state on backing-device folios.

How to confirm the fix worked

Confirm the applied kernel source contains the wait-for-writeback logic in nilfs_segctor_do_construct; reproduce by mounting nilfs2 and issuing direct device writes while monitoring for absence of the page-writeback BUG.

Typical attack path

1. Obtain write access to the raw block device hosting a mounted nilfs2 filesystem
2. Perform destructive writes that overlap with active nilfs2 segment construction
3. Allow nilfs_segctor_thread to initiate writeback without waiting for prior operations
4. Trigger the inconsistent writeback state that causes the kernel BUG

How to detect it

Inspect kernel logs for entries containing 'kernel BUG at mm/page-writeback.c:3070' together with stack traces referencing nilfs_segctor_do_construct and __folio_start_writeback.

What your security team should do

• Apply the kernel update containing commit 95f6f81e50d858a7c9aa7c795ec14a0ac3819118 on all systems using nilfs2
• Review kernel logs for page-writeback BUGs or oops involving nilfs_segctor
• Disable nilfs2 module if the filesystem is not required