CVE-2024-41049

What it actually does

A use-after-free vulnerability in posix_lock_inode where a lock entry pointer is dereferenced after being freed due to a race condition before a tracepoint executes.

Why it matters to the business

Potential system instability or crashes on Linux systems, with low likelihood of exploitation; requires kernel updates to maintain reliability across servers and devices.

How an attack unfolds

An attacker triggers concurrent file locking operations to race the freeing of a lock structure with tracepoint access in the kernel.

How to fix it

Update Linux kernel to version 5.4.280 or apply commit 1cbbb3d9475c403ebedc327490c7c2b991398197 in the stable repository.

How to confirm the fix worked

Verify kernel version is at or above the fixed release; monitor for KASAN warnings related to posix_lock_inode.

Typical attack path

1. Identify target Linux system with vulnerable kernel
2. Craft workload involving posix file locks from multiple tasks
3. Trigger race to cause UAF

How to detect it

Look for kernel logs indicating use-after-free in file lock functions or KASAN reports mentioning trace_posix_lock_inode.

What your security team should do

• Prioritize kernel updates on all Linux systems
• Monitor for any related stability issues
• Apply patches from stable kernel branches