CVE-2024-46701

What it actually does

Race condition in tmpfs offset directory operations allows concurrent renames to insert dentries with monotonically increasing keys into the maple tree, causing readdir to loop indefinitely instead of terminating.

Why it matters to the business

Local processes performing directory listings on tmpfs can hang or consume excessive CPU, leading to application slowdowns or denial of service on systems using tmpfs for temporary storage or caches.

How an attack unfolds

An attacker with local access creates many files in a tmpfs directory, then interleaves readdir calls with repeated rename operations that trigger new offset allocations; this forces the directory iterator to never reach the end condition, producing infinite results or test failures.

How to fix it

Upgrade the Linux kernel to commit 308b4fc2403b335894592ee9dc212a5e58bb309f or a later stable release that records last_index at directory open time and suppresses emission of later entries; apply the same fix to any downstream distributions.

How to confirm the fix worked

After patching, confirm the kernel version contains the fix commit, then execute xfstests generic/736 or an equivalent workload that interleaves readdir with renames to verify termination within expected bounds.

Typical attack path

1. Obtain local shell or process execution on the target system
2. Create a large number of files under a tmpfs-backed directory
3. Open the directory and begin iterating entries via readdir
4. Concurrently perform rename(entry, temp) followed by rename(temp, entry) in a tight loop
5. Observe readdir either returning no results after excessive iterations or looping without termination

How to detect it

Search kernel logs and audit trails for processes stuck in readdir or iterate_dir on tmpfs mounts; correlate with high CPU usage on directory operations and failed or long-running xfstests or application directory scans.

What your security team should do

• Prioritize kernel updates on all systems using tmpfs (containers, /tmp, /dev/shm) within standard patch windows
• Monitor for local privilege-escalation chains that could combine this hang with other kernel bugs
• Review any custom tmpfs workloads or test suites for similar infinite-loop exposure