CVE-2024-41020

What it actually does

Missing application of the fcntl/close race recovery fix to the compat path for 64-bit offsets on 32-bit kernels leaves file locks in an inconsistent state after a detected race.

Why it matters to the business

32-bit Linux systems may experience kernel instability, unexpected process termination, or potential local privilege escalation during file locking operations until patched.

How an attack unfolds

An attacker on an unpatched 32-bit kernel triggers concurrent fcntl and close calls on the same file descriptor; the unhandled compat path fails to remove locks reliably, allowing the race to be abused for further memory corruption or denial of service.

How to fix it

Upgrade the Linux kernel to the commit a561145f3ae973ebf3e0aee41624e92a6c5cb38d or later stable release containing the fix for both normal and compat paths.

How to confirm the fix worked

Verify the running kernel contains commit a561145f3ae973ebf3e0aee41624e92a6c5cb38d via git log or uname output matching a patched release; re-run fcntl/close race test cases to confirm lock cleanup.

Typical attack path

1. Identify 32-bit Linux kernel target without the compat-path fix
2. Open a file and obtain a lock via fcntl
3. Race fcntl unlock against close from another thread
4. Exploit residual lock state for memory corruption or crash
5. Escalate to kernel code execution or system denial of service

How to detect it

Review kernel logs for filelock-related warnings, oops, or hung-task messages around fcntl/close operations; correlate with process termination or lock leaks on 32-bit systems.

What your security team should do

• Prioritize kernel updates on all 32-bit systems within the next patch cycle
• Apply the referenced commit to any custom or LTS kernels still missing the compat-path change
• Monitor vendor advisories for backported stable releases
• Restrict untrusted local code execution on 32-bit endpoints until updated