CVE-2024-41083

What it actually does

The flaw allows a NULL pointer dereference in netfs_page_mkwrite() when folio->mapping becomes invalid after acquiring the folio lock due to interference from invalidate_inode_pages2_range() during concurrent DIO writes and mmap writes, resulting in a kernel oops.

Why it matters to the business

Systems may experience unexpected kernel crashes and reboots during file I/O operations involving memory-mapped files and direct writes, leading to downtime and potential data corruption risks in Linux environments using affected kernels.

How an attack unfolds

An attacker with local access crafts a sequence of direct I/O writes and concurrent mmap page faults on the same file to trigger the race between invalidate_inode_pages2_range() and netfs_page_mkwrite(), causing the kernel to dereference a NULL mapping pointer and panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 3473eb87afd402e415a8ca885b284ea0420dde25 or later. Rebuild and reboot into the patched kernel. Apply vendor-provided updates for distributions based on the affected stable trees.

How to confirm the fix worked

Verify the running kernel includes commit 3473eb87afd402e415a8ca885b284ea0420dde25 via git log or kernel version string. Reproduce the generic/247 test case or similar mmap/DIO workloads to confirm absence of oopses. Monitor dmesg for related NULL dereference traces.

Typical attack path

1. Obtain local unprivileged access to a system running an affected kernel
2. Open a file and initiate direct I/O writes while performing mmap writes on overlapping regions
3. Trigger invalidate_inode_pages2_range() at the end of the DIO operation
4. Cause netfs_page_mkwrite() to proceed without a valid folio mapping
5. Induce NULL pointer dereference and kernel oops

How to detect it

Review kernel logs for NULL pointer dereference traces referencing netfs_page_mkwrite, trace_event_raw_event_netfs_folio, or page_fault_oops during file I/O. Correlate with processes performing mmap and O_DIRECT writes on the same files.

What your security team should do

• Prioritize kernel updates on systems performing heavy netfs, mmap, or DIO workloads
• Apply patches within standard maintenance windows given low EPSS and no known exploitation
• Test patched kernels in staging environments with I/O intensive workloads before production deployment
• Monitor for kernel oops reports involving netfs_page_mkwrite or trace_netfs_folio