CVE-2024-44939

What it actually does

Null pointer dereference in dtInsertEntry caused by flag modification in UniStrncpy_to_le leading to incorrect branch and access of uninitialized object when freelist is zero.

Why it matters to the business

Local denial of service via kernel panic on systems using the JFS filesystem; limited real-world impact given low EPSS and lack of KEV listing.

How an attack unfolds

An attacker with local access crafts JFS directory operations that reach dtInsertEntry with a zero freelist; the page header flag is cleared during name copy, causing a second conditional check to take the wrong path and dereference an uninitialized pointer, triggering a general protection fault.

How to fix it

Upgrade the Linux kernel to a version containing commit f98bf80b20f4a930589cda48a35f751a64fe0dc2 or later; Android devices should apply the corresponding 2022-12-01 security patches for affected framework/base versions.

How to confirm the fix worked

Confirm kernel source contains the freelist==0 check before the header flag test in dtInsertEntry; verify running kernel version against fixed commits or patch level.

Typical attack path

1. Obtain local unprivileged access on a Linux system with JFS mounted
2. Trigger dtInsert via crafted directory or file creation operations
3. Force freelist==0 condition after page acquisition
4. Cause flag overwrite and subsequent uninitialized access
5. Induce kernel panic via null dereference

How to detect it

Review kernel logs for general protection faults referencing dtInsertEntry or jfs_dtree.c; look for syzbot-style fuzzing artifacts or repeated JFS mount and directory modification events preceding crashes.

What your security team should do

• Prioritize kernel updates on any systems still using JFS
• Audit for JFS usage in production workloads and migrate to supported filesystems where possible
• Monitor for local privilege escalation attempts that could chain this DoS into further impact