CVE-2024-46786

What it actually does

Use-after-free in fscache module: fscache_cookie_lru_timer is scheduled via timer_reduce but never deleted on module unload, leaving a dangling timer that fires in softIRQ context after the module memory is freed.

Why it matters to the business

Local attackers can trigger kernel crashes or potential code execution on Linux systems using fscache, causing downtime, data corruption, or full host compromise; high prevalence in server and container workloads increases exposure.

How an attack unfolds

An attacker with local module-loading rights loads the fscache module, forces timer scheduling, unloads the module, then waits for the softIRQ timer handler to dereference freed memory, resulting in a page fault during timer processing.

How to fix it

Apply the upstream fix in commit c1fc36d5470335546c45799d94d7bb2cbc09e8b7 or equivalent stable backports that delete fscache_cookie_lru_timer on module exit; update affected Go packages to pion/dtls 1.5.2 where relevant.

How to confirm the fix worked

Confirm the timer deletion call is present in the fscache exit path of the running kernel; attempt module load/unload cycles under load and verify absence of timer-related page faults or KASAN reports.

Typical attack path

1. Obtain local access with CAP_SYS_MODULE or equivalent
2. Load fscache kernel module
3. Invoke operations that call timer_reduce on fscache_cookie_lru_timer
4. Unload fscache module
5. Trigger softIRQ execution of the stale timer

How to detect it

Search kernel logs and crash dumps for oops traces containing __run_timer_base, tmigr_handle_remote, fscache_cookie_lru_timer, and recent netfs or fscache module unload events.

• BUG: unable to handle page fault for address
• __run_timer_base.part.0
• fscache_cookie_lru_timer
• Modules linked in: [last unloaded: netfs]
• Tainted: G W

What your security team should do

• Immediately upgrade Linux kernels to a version containing the timer deletion fix
• Restrict unprivileged module loading via kernel lockdown or module signing
• Audit systems for fscache usage and schedule reboots after patching
• Add kernel oops monitoring for __run_timer_base faults involving fscache