CVE-2024-39276

What it actually does

Reference count leak of mb_cache_entry e_refcnt in ext4_xattr_block_cache_find when ext4_sb_bread returns -ENOMEM, leading to unbalanced increments that trigger warnings in mb_cache_destroy during superblock shutdown.

Why it matters to the business

Linux systems using ext4 may experience kernel warnings or minor resource accounting issues under memory pressure during unmount; affects the core kernel used across servers, desktops, and embedded devices with no ransomware or KEV exploitation reported.

How an attack unfolds

A local attacker triggers the error path in ext4 extended attribute block cache lookup by inducing ENOMEM during bread operations, leaving reference counts leaked until shutdown.

How to fix it

Update the Linux kernel to the fixed commit d8a5b80568a9cb66810e75b182018e9edb68e8ff or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit d8a5b80568a9cb66810e75b182018e9edb68e8ff; reproduce the original syzbot reproducer under memory pressure and confirm no mb_cache_destroy warning occurs.

Typical attack path

1. Obtain local user access on an ext4 filesystem
2. Perform file operations that invoke ext4_xattr_block_cache_find under memory exhaustion conditions
3. Cause ext4_sb_bread to fail with -ENOMEM
4. Trigger filesystem unmount or shutdown to surface the leak warning

How to detect it

Inspect kernel logs for WARNING messages from mb_cache_destroy or ext4_put_super related to reference count leaks; correlate with ext4 unmount events under memory pressure.

What your security team should do

• Prioritize kernel updates on all ext4-using systems within standard patch cycles
• Monitor kernel logs for mb_cache_destroy warnings as a stability indicator
• Test the patch in staging environments before broad deployment