CVE-2024-41051

What it actually does

Use-after-free in Linux kernel cachefiles when ondemand_object_worker runs after cachefiles_object is freed during intentional request completion and erofs unmount, triggered because the object is not pinned while work is queued.

Why it matters to the business

Linux systems using cachefiles with ondemand features face kernel instability or crashes; unpatched kernels in long-running or containerized environments increase operational risk until upgrades are applied, though no active ransomware or KEV usage is recorded.

How an attack unfolds

An attacker with local access crafts a sequence of cachefiles_ondemand_send_req, fd close, daemon release, and unmount operations to free the object while queued work still executes, leading to use-after-free; listed threat actor campaigns focus on other kernel issues rather than this specific flaw.

How to fix it

Upgrade Linux kernel to version 6.1.100 or apply commit ec9289369259d982e735a71437e32e6b4035290c in stable trees; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm kernel version reports 6.1.100 or later; verify the patch commit is present in the running kernel source; test cachefiles ondemand workflows under load and unmount scenarios for absence of UAF symptoms.

Typical attack path

1. Trigger cachefiles_ondemand_send_req to queue a read request
2. Close ondemand fd to mark object CLOSE then REOPENING
3. Release daemon and flush requests to complete the read
4. Unmount the erofs filesystem to free the object via put_object
5. Allow ondemand_object_worker to execute on the freed object

How to detect it

Review kernel logs for use-after-free oops or warnings referencing cachefiles_ondemand or ondemand_object_worker; examine audit trails around erofs unmounts and cachefiles fd close events near the time of any kernel panics.

What your security team should do

• Prioritize kernel upgrades on all systems exposing cachefiles or erofs
• Monitor upstream stable branches for additional backports beyond 6.1.100
• Restrict unprivileged access to cachefiles ondemand interfaces where feasible
• Schedule validation testing in staging environments before production rollout