CVE-2024-43826

What it actually does

nfs_folio_length can be called without folio lock or valid mapping during truncation, allowing NULL dereference or use-after-free when NFS tracepoints are enabled, resulting in kernel crash.

Why it matters to the business

Systems using NFS with tracing enabled can experience unexpected kernel panics, leading to downtime and potential data corruption risk during file operations; high prevalence of Linux NFS increases exposure across servers and containers.

How an attack unfolds

An attacker with local access enables NFS tracepoints and performs file operations that trigger folio truncation; the unsafe nfs_folio_length call then dereferences invalid memory, crashing the kernel. No known threat actors or ransomware use.

How to fix it

Update Linux kernel to a version containing the fix that passes explicit offset and length to NFS trace events instead of calling nfs_folio_length; disable NFS tracepoints as a temporary mitigation if patching is delayed.

How to confirm the fix worked

Confirm kernel version includes the nfs tracepoint change; run xfstests generic/065 with NFS tracepoints enabled and verify no crashes; inspect trace event definitions for explicit offset/count parameters.

Typical attack path

1. Obtain local access to NFS client system
2. Enable all NFS tracepoints via tracefs or ftrace
3. Trigger NFS I/O that causes folio truncation (e.g., via xfstests or similar workloads)
4. nfs_folio_length reads unlocked folio causing NULL mapping dereference
5. Kernel oops/panic occurs

How to detect it

Search kernel logs and dmesg for oops/panic messages mentioning nfs_folio_length, folio mapping NULL, or NFS trace events; review ftrace logs for calls around truncation operations.

What your security team should do

• Apply kernel update containing the NFS tracepoint fix immediately on all affected systems
• Temporarily disable NFS tracepoints in production until patched
• Monitor for kernel panics referencing nfs_folio_length or folio mapping
• Prioritize patching servers with high NFS usage given 3041 downstream dependents