CVE-2024-47736

What it actually does

Deadlock in erofs compressed I/O path when processing crafted images containing physically overlapped pclusters; managed folios are marked up-to-date and unlocked early, but z_erofs_fill_bio_vec and BIO submission order create circular waits on folio locks.

Why it matters to the business

Local denial-of-service on systems that mount untrusted or attacker-supplied erofs images, resulting in hung tasks and potential system unavailability; low prevalence outside fuzzing or malicious environments reduces broad operational risk.

How an attack unfolds

An attacker supplies a malicious erofs filesystem image containing overlapped big pclusters, mounts it on a vulnerable kernel, and triggers compressed I/O operations that cause the kernel to wait indefinitely for a folio lock held by another BIO submission.

How to fix it

Upgrade the Linux kernel to a version containing commit 1bf7e414cac303c9aec1be67872e19be8b64980c or later; avoid mounting untrusted erofs images on unpatched systems; disable erofs if not required.

How to confirm the fix worked

Verify kernel source or package version includes the referenced commit; attempt to mount a known fuzzed image that previously triggered the hang and confirm the operation completes without deadlock.

Typical attack path

1. Create or obtain a crafted erofs image with overlapping physical pclusters
2. Mount the image on a vulnerable Linux kernel
3. Perform file operations that trigger compressed I/O on the overlapped extents
4. Observe task hang due to unresolved folio lock dependency

How to detect it

Inspect kernel logs and task traces for prolonged waits on folio locks originating from erofs compressed I/O paths; correlate with recent mounts of erofs images from untrusted sources.

What your security team should do

• Apply the kernel patch containing commit 1bf7e414cac303c9aec1be67872e19be8b64980c at the earliest maintenance window
• Restrict mounting of erofs filesystems to trusted sources only
• Monitor for kernel task hangs referencing erofs or z_erofs code paths
• Review system configurations that allow unprivileged users to mount arbitrary filesystems