CVE-2024-41001

What it actually does

The vulnerability is a memory leak in the audit subsystem triggered during io_uring connect preparation in SQPOLL threads when no prior audit calls have occurred, leading to unreferenced kernel memory allocations for sockaddr structures.

Why it matters to the business

Over time this can lead to gradual memory exhaustion on systems using io_uring with SQPOLL threads, causing performance degradation or service disruptions in high-throughput Linux environments such as servers and containers.

How an attack unfolds

An attacker triggers repeated io_uring connect operations through SQPOLL threads to activate the audit path on the prep side without prior audit activity inside issue(), causing the kernel to allocate but not free audit memory; listed threat actors in espionage and financially motivated campaigns have targeted similar Linux kernel resource issues but no confirmed exploitation of this specific leak is noted.

How to fix it

Update the Linux kernel to include commit 55c22375cbaa24f77dd13f9ae0642915444a1227 or later; apply the fix across all affected stable branches and rebuild custom kernels if necessary.

How to confirm the fix worked

Verify the presence of commit 55c22375cbaa24f77dd13f9ae0642915444a1227 in the kernel source or git log; run kmemleak scans after io_uring connect workloads to confirm absence of the unreferenced audit object.

Typical attack path

1. Identify systems running io_uring with SQPOLL enabled
2. Submit sequences of connect sqes via the submission queue
3. Ensure the SQPOLL thread has no prior audit-triggering operations
4. Repeat to accumulate leaked audit sockaddr allocations

How to detect it

Inspect kmemleak reports for unreferenced objects allocated via __audit_sockaddr in io_sq_thread or iou-sqp contexts; correlate with process names containing iou-sqp and increasing memory usage in audit-related kernel slabs.

What your security team should do

• Apply kernel updates containing the referenced commit as soon as possible on all production systems
• Audit usage of io_uring SQPOLL in internal workloads and prioritize patching high-traffic hosts
• Enable kmemleak or similar memory debugging in test environments to monitor for leaks
• Review downstream package distributions for backported fixes