CVE-2024-42300

What it actually does

Race condition in z_erofs_get_gbuf allows current task migration between gbuf ID selection and spin_lock acquisition, resulting in mismatched buffer ownership and kernel BUG on put_gbuf during LZ4 decompression or readahead.

Why it matters to the business

Systems using EROFS may experience kernel crashes under concurrent load or stress, causing downtime and reduced stability across thousands of downstream dependents; patch urgency is moderate given low exploit maturity and no KEV listing.

How an attack unfolds

An attacker with local access triggers repeated erofs decompression or readahead operations under CPU contention to induce task migration between gbuf ID query and lock, forcing the put_gbuf path to hit the BUG condition shown in stress-test traces.

How to fix it

Upgrade Linux kernel to 6.10.3 or later stable branch containing commit 49b22e06a947727a6d1c802d2d9ad92420b90fc5; rebuild and reboot affected systems; apply distribution backports where available.

How to confirm the fix worked

Confirm kernel version >= 6.10.3, verify absence of the race by reviewing zutil.c around line 58, and run stress tests exercising erofs readahead and LZ4 paths without triggering the BUG.

Typical attack path

1. Obtain local code execution or user shell on target
2. Mount or access EROFS filesystem and initiate concurrent read/decompress operations
3. Apply CPU load or migration to trigger the window between gbuf ID and spin_lock
4. Cause z_erofs_put_gbuf to dereference wrong CPU buffer and panic the kernel

How to detect it

Search kernel logs for the signature BUG at fs/erofs/zutil.c:58 and call traces containing z_erofs_put_gbuf, z_erofs_lz4_decompress, and z_erofs_readahead; correlate with erofs mount activity and stress or high-concurrency workloads.

What your security team should do

• Prioritize kernel upgrades on any hosts using EROFS within the next maintenance window
• Monitor for erofs-related kernel panics in system logs
• Disable EROFS mounts where not required until patched
• Track EPSS and exploit maturity updates for changes in priority