CVE-2024-41074

What it actually does

Malicious userspace copen call with negative ondemand_id deletes an unread request and leaves the cachefiles object in a reopen state; select_req then perpetually skips the request, preventing read completion and blocking dependent processes.

Why it matters to the business

Attackers can induce process hangs and I/O stalls on affected Linux systems, disrupting file caching services and any workloads that depend on them; urgency is moderate given low EPSS and absence from KEV.

How an attack unfolds

An attacker invokes copen from userspace with a crafted negative id, causing premature request deletion; the object transitions to reopen without completing the original read, so subsequent select_req calls skip it indefinitely and starve waiting processes.

How to fix it

Upgrade the Linux kernel to a version containing commit 703bea37d13e4ccdafd17ae7c4cb583752ba7663 (or the equivalent stable backport) so that copen sets the object to close when ondemand_id < 0.

How to confirm the fix worked

Verify the running kernel contains commit 703bea37d13e4ccdafd17ae7c4cb583752ba7663; attempt a negative-id copen call in a test environment and confirm the request is no longer left in a perpetual skipped state.

Typical attack path

1. Locate a Linux system exposing the cachefiles ondemand interface
2. Invoke copen with a negative ondemand_id from an unprivileged context
3. Trigger the resulting request-skipping loop inside the kernel
4. Observe blocked processes and denial-of-service symptoms

How to detect it

Inspect kernel logs for cachefiles messages indicating skipped requests or uncompleted reads; correlate with processes stuck in D-state waiting on cachefiles objects; review audit trails for unusual copen invocations.

What your security team should do

• Apply the referenced kernel commit or later stable release as soon as practical
• Limit untrusted userspace access to the cachefiles ondemand interface
• Monitor system logs for cachefiles request timeouts or stalled worker threads
• Include the fixed commit hash in vulnerability scanning and patch-compliance checks