CVE-2024-40900

What it actually does

Use-after-free in Linux kernel cachefiles subsystem allowing access to a freed request structure during request flushing when CACHEFILES_DEAD is set, due to incomplete removal from the xarray before completion and kfree.

Why it matters to the business

Kernel crashes, potential privilege escalation, or system instability on affected Linux distributions, increasing operational risk for servers and devices relying on cachefiles for on-demand caching; widespread impact given Linux kernel prevalence though low exploitability score.

How an attack unfolds

An attacker with local access triggers cachefiles_ondemand_init_object and send_req to allocate a request, then races with daemon threads performing cachefiles_flush_reqs and xa operations after fd close to access the freed request object via cachefiles_ondemand_select_req, leading to use-after-free.

How to fix it

Update the Linux kernel to include commit 9f13aacdd4ee9a7644b2a3c96d67113cd083c9c7 or later stable releases containing the fix that removes requests from the xarray during flushing.

How to confirm the fix worked

Verify kernel source contains the patch removing requests from cache->reqs in cachefiles_flush_reqs; test by reproducing the described concurrency scenario and confirming no UAF occurs; monitor for stable kernel updates post-2024-07-12.

Typical attack path

1. Mount or access a filesystem using cachefiles ondemand mode
2. Initiate a request via cachefiles_ondemand_send_req allocating REQ_A
3. Trigger daemon read and close the device fd to invoke flush_reqs
4. Race completion and kfree of REQ_A with xarray lookup in select_req
5. Access freed request causing UAF during opcode check

How to detect it

Review kernel logs and crash dumps for cachefiles related UAF signatures or warnings around request flushing; inspect for unexpected xa operations or daemon thread interactions with ondemand requests; correlate with process activity involving cachefiles device nodes.

What your security team should do

• Prioritize kernel updates on all systems using cachefiles or fscache
• Apply the specific commit or equivalent backport immediately on exposed hosts
• Harden access controls around device files and ondemand caching features
• Monitor kernel logs for related crashes or warnings in cachefiles code