CVE-2024-38384

What it actually does

Data race in __blkcg_rstat_flush allows WRITE to ->lqueued to be reordered with READ of bisc->lnode.next, causing local list corruption when blk_cgroup_bio_start concurrently adds a stat instance.

Why it matters to the business

Linux systems may experience kernel memory corruption leading to crashes, denial of service, or local privilege escalation; high CVSS and kernel-wide exposure increase urgency for patching despite low EPSS.

How an attack unfolds

An attacker with local access triggers concurrent block I/O cgroup accounting and rstat flushing; the missing memory barrier permits the list to be corrupted during the flush loop, enabling further memory manipulation or crashes.

How to fix it

Update the Linux kernel to the commit 714e59b5456e4d6e4295a9968c564abe193f461c or later stable releases that include the memory barrier fix; apply vendor kernel packages as soon as available.

How to confirm the fix worked

Confirm the running kernel contains commit 714e59b5456e4d6e4295a9968c564abe193f461c via git log or uname; test concurrent I/O and cgroup stat flushing workloads to verify absence of list corruption.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux kernel
2. Issue concurrent blk_cgroup_bio_start operations while __blkcg_rstat_flush runs
3. Trigger write-to-queued reordering to corrupt the local list in the flush path
4. Leverage resulting memory corruption for denial of service or privilege escalation

How to detect it

Search kernel logs and crash dumps for list corruption warnings or oopses involving blkcg_rstat_flush or bisc->lnode; review audit logs for unusual concurrent block I/O and cgroup activity around crash times.

What your security team should do

• Prioritize kernel updates on all Linux hosts within the next maintenance window
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict unprivileged local access where possible until patched
• Review cgroup and block I/O workloads for unexpected crashes as a temporary indicator