CVE-2024-41075

What it actually does

Improper input validation in the Linux kernel cachefiles subsystem allows malicious processes to complete arbitrary copen or cread requests, bypassing checks that ondemand_id must be non-zero for copen, that copen/cread match open/read request types, and that fd/req objects match for cread, resulting in system crashes.

Why it matters to the business

Unprivileged local processes can trigger kernel panics and repeated system crashes, causing denial of service, workload disruption, and unplanned downtime on affected Linux systems; the issue has low exploitability probability and is not known to be used in ransomware or KEV campaigns.

How an attack unfolds

An attacker with local access crafts or intercepts ondemand cachefiles requests and uses a malicious process to issue copen or cread completions with mismatched or zeroed identifiers; absent consistency checks allow the requests to be fulfilled incorrectly, corrupting internal state and crashing the kernel. No named threat actors have been observed exploiting this specific flaw.

How to fix it

Update the Linux kernel to the fixed commit 3b744884c0431b5a62c92900e64bfd0ed61e8e2a or later stable releases that include the consistency checks for copen and cread; rebuild and reboot with the patched kernel. No temporary mitigations are documented beyond disabling ondemand cachefiles usage if feasible.

How to confirm the fix worked

Confirm the running kernel contains commit 3b744884c0431b5a62c92900e64bfd0ed61e8e2a or a backport that adds the listed copen/cread checks; review cachefiles source for the three validation conditions and test that invalid completions are rejected without crashing.

Typical attack path

1. Obtain local unprivileged access on a system using cachefiles ondemand mode
2. Identify or trigger pending copen/cread requests via the cachefiles daemon interface
3. Submit crafted completion requests that violate type, ondemand_id, or object-matching rules
4. Cause the kernel to process the invalid completion and panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for cachefiles-related oops or panic messages around the time of suspected activity; look for unexpected process interactions with the cachefiles daemon or ondemand request completions that precede crashes. No public IOCs or exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on all systems using cachefiles ondemand functionality
• Monitor for local privilege-escalation or crash reports involving cachefiles
• Restrict untrusted local code execution on multi-tenant or shared Linux hosts until patched