CVE-2024-40935

What it actually does

In ondemand mode, marking the cache CACHEFILES_DEAD causes cachefiles_daemon_write to return -EIO, preventing copen responses and leaving kernel waiters in a hung_task state; the fix flushes all requests after setting the irreversible DEAD state to avoid this.

Why it matters to the business

Systems using Linux kernel cachefiles in ondemand mode can experience task hangs and service disruption after cache I/O errors, increasing operational downtime risk in environments with high cache dependency.

How an attack unfolds

An attacker triggers cache I/O errors to invoke cachefiles_io_error and set CACHEFILES_DEAD; with ondemand requests pending, the daemon cannot deliver copen, causing hung tasks. Listed threat actors have targeted similar Linux kernel resource and write flaws in espionage and financially motivated campaigns.

How to fix it

Update to a kernel containing commit 320ba9cbca78be79c912143bbba1d1b35ca55cf0 (or equivalent stable backport); rebuild and reboot affected systems. For pandorafms/pandorafms deployments, apply commit 3c409813f14722c2290c7854f555599d9720d4d4.

How to confirm the fix worked

Confirm kernel source contains the reference-counting and flush logic after CACHEFILES_DEAD; run cachefiles stress tests that force I/O errors and verify no hung_task occurs; check dmesg for absence of the prior deadlock pattern.

Typical attack path

1. Trigger I/O error path in cachefiles to call cachefiles_io_error
2. Kernel sets CACHEFILES_DEAD flag while ondemand open requests are in flight
3. Daemon receives -EIO on write and cannot forward copen
4. Waiting kernel processes enter hung_task state

How to detect it

Search kernel logs and task dumps for CACHEFILES_DEAD combined with hung_task warnings on cachefiles_daemon_write paths; correlate with /dev/cachefiles activity and ondemand open requests.

• CACHEFILES_DEAD
• cachefiles_daemon_write.*-EIO
• hung_task.*copen
• cachefiles_io_error

What your security team should do

• Prioritize patching Linux kernel cachefiles within 30 days given 823 days since publication and stable EPSS
• Audit systems for ondemand cachefiles usage and schedule maintenance windows
• Add monitoring for CACHEFILES_DEAD transitions and hung_task events
• Test patch in staging before broad deployment