CVE-2024-47669

What it actually does

In nilfs2 log writing, error paths in nilfs_segctor_do_construct() fail to invoke nilfs_segctor_abort_construction() on failures after the first log, leaving writeback flags set on pages/folios and NILFS_I_COLLECTED flags uncleared on inodes; this causes page cache hangs on operations such as truncate_inode_pages_final and erroneous inode removal from sc_dirty_files leading to unwritten data and b-tree blocks.

Why it matters to the business

Organizations running Linux with nilfs2 may experience system hangs during inode eviction or file truncation and risk filesystem corruption that results in data loss or extended downtime; prevalence in Linux distributions and dependent packages increases exposure across servers and embedded systems.

How an attack unfolds

An attacker with local access mounts or uses a nilfs2 filesystem and induces repeated log write errors (for example via I/O failures or specific segment construction conditions) so that the flawed error handling path leaves inconsistent page and inode state; subsequent checkpoint or partial log operations then trigger hangs or silent data corruption without requiring network access or elevated privileges beyond filesystem interaction.

How to fix it

Upgrade the Linux kernel to a version containing commit 40a2757de2c376ef8a08d9ee9c81e77f3c750adf or later; rebuild and reboot with the patched kernel; verify nilfs2 is no longer in use on systems where immediate upgrade is not feasible and consider switching to a different filesystem.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or is newer than the listed fixed versions; exercise nilfs2 log writes under error injection and verify that writeback flags are cleared and NILFS_I_COLLECTED flags do not cause inode list corruption; monitor for absence of hangs in truncate_inode_pages_final.

Typical attack path

1. Obtain local user access on a system using nilfs2
2. Trigger conditions that cause nilfs_segctor_begin_construction to fail on second or later logs
3. Force inode eviction or checkpoint operations that rely on cleared flags
4. Observe or exploit resulting page cache hang or block mapping corruption

How to detect it

Search kernel logs and dmesg for nilfs2 segctor error paths, repeated log write failures, or stalls in truncate_inode_pages_final; inspect for unexpected inode list behavior during checkpoint operations; review system hangs correlated with nilfs2 activity.

What your security team should do

• Prioritize kernel updates on all systems using nilfs2 within the next maintenance window
• Audit for nilfs2 usage across the fleet and migrate high-value workloads to alternative filesystems
• Enable kernel crash and hang detection tooling to surface related page cache stalls
• Review backup integrity for any nilfs2 volumes that may have experienced partial writes