CVE-2024-40913

What it actually does

Use-after-free in cachefiles due to exposing an anonymous fd via fd_install() before ensuring a reference count on the cache object, allowing premature close_fd() to drop the last reference and free the cache while still in use.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption leading to crashes, denial of service, or potential privilege escalation; widespread impact on servers, desktops, and embedded devices running vulnerable kernels with no ransomware or nation-state exploitation recorded to date.

How an attack unfolds

An attacker with local access crafts a sequence that installs the anonymous fd before copy_to_user() completes, closes the fd from userspace to trigger put on the cache, and reuses the freed object before the kernel finishes initialization, exploiting the reference-counting race.

How to fix it

Upgrade the Linux kernel to commit eac51d9daacd61dcc93333ff6a890cf3efc8c1c0 or later stable releases that defer fd_install() until after copy_to_user() succeeds and the cache reference is held.

How to confirm the fix worked

Verify the running kernel contains commit eac51d9daacd61dcc93333ff6a890cf3efc8c1c0; confirm cachefiles fd installation occurs only after successful copy_to_user() via source inspection or vendor advisory.

Typical attack path

1. Obtain local code execution on a system running a vulnerable kernel
2. Open cachefiles interface and trigger fd allocation path
3. Race fd_install() with close from userspace before cache reference is acquired
4. Trigger UAF by accessing the now-freed cache object in subsequent kernel operations
5. Escalate to kernel code execution or cause denial of service

How to detect it

Review kernel logs for cachefiles UAF warnings or oops traces referencing cache reference counts; examine audit logs for unexpected close operations on anonymous fds around cachefiles activity; no public IOCs or exploit artifacts are currently known.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-user Linux systems within 30 days
• Enable kernel hardening features such as KASAN or SLUB_DEBUG to increase exploit difficulty
• Restrict unprivileged local access where feasible until patches are applied
• Monitor vendor and distribution security lists for backported fixes