CVE-2024-41023

What it actually does

Causes a reference count leak on task_struct objects when a deadline timer set by start_dl_timer() is canceled by enqueue_task_dl() before dl_task_timer() can decrement the count, leaving allocated kernel memory unreleased.

Why it matters to the business

Extended operation under deadline-scheduling workloads on Linux systems can exhaust kernel memory, leading to instability, performance degradation, or denial of service. The vulnerability affects the widely used Linux kernel with numerous downstream dependents, increasing the need for prompt remediation.

How an attack unfolds

An attacker with local access runs or induces workloads that repeatedly invoke clone operations and deadline scheduling paths, causing start_dl_timer to increment task_struct references followed by immediate cancellations that skip the decrement, accumulating leaked objects over time.

How to fix it

Update the Linux kernel to a version containing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be or later; rebuild and deploy the fixed kernel across all affected systems.

How to confirm the fix worked

Confirm the running kernel includes commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be; re-execute stress-ng cyclic workloads with kmemleak enabled and verify absence of task_struct leaks in reports.

Typical attack path

1. Obtain local code execution on an affected Linux system
2. Trigger repeated fork/clone operations combined with deadline scheduling
3. Cause enqueue_task_dl to cancel pending dl timers before expiration
4. Accumulate unreleased task_struct references until memory pressure occurs

How to detect it

Inspect kmemleak output for unreferenced task_struct objects whose backtraces include dup_task_struct, copy_process, and kernel_clone; correlate with processes using deadline scheduling and watch for sustained memory growth without corresponding process termination.

• unreferenced object.*task_struct
• dup_task_struct+0x30/0x540
• start_dl_timer
• dl_task_timer

What your security team should do

• Apply the kernel fix commit immediately on all production systems
• Monitor kernel memory usage and kmemleak output for task_struct leaks
• Limit untrusted local code execution until patches are deployed