CVE-2024-49889

What it actually does

Use-after-free in ext4_ext_show_leaf() when a saved path pointer is dereferenced after ext4_find_extent() frees or reallocates the path during extent splitting or unwritten extent handling under EXT_DEBUG builds.

Why it matters to the business

Negligible operational risk in standard deployments because the flaw exists only in debug-compiled kernels; production kernels are unaffected and no widespread exploitation has been observed despite listed threat actor activity in the broader Linux kernel space.

How an attack unfolds

An attacker would need a specially compiled kernel with EXT_DEBUG enabled, trigger ext4 extent split operations that cause find_extent to free the path, then invoke ext4_ext_show_leaf on the dangling pointer; listed espionage and financially motivated actors have targeted other Linux kernel issues but no evidence ties them to this debug-only path.

How to fix it

Upgrade affected packages to the listed fixed versions: containernetworking-plugins 0:0.8.3-4.module+el8.5.0+770+e2f49861, cockpit-podman 0:11-1.module+el8.5.0+770+e2f49861, python-podman-api 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861, udica 0:0.2.1-2.module+el8.5.0+770+e2f49861, container-selinux 2:2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f, slirp4netns 0:0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861, or kernel commit b0cb4561fc4284d04e69c8a66c8504928ab2484e.

How to confirm the fix worked

Verify kernel source no longer contains the stale path variable in ext4_split_extent_at and ext4_ext_handle_unwritten_extents, confirm EXT_DEBUG builds pass ext4 extent debug tests, and ensure running kernels report the fixed commit hash.

Typical attack path

1. Compile or obtain kernel with EXT_DEBUG defined
2. Perform filesystem operations that invoke ext4_split_extent or ext4_ext_handle_unwritten_extents
3. Force error paths in ext4_find_extent that free the path
4. Reach ext4_ext_show_leaf with stale path pointer

How to detect it

Search kernel logs and debug traces for ext4_ext_show_leaf calls referencing freed path structures; no production indicators exist because the code path is compile-time disabled.

What your security team should do

• Apply the listed fixed package versions immediately on Rocky Linux 8 systems
• Confirm no custom kernels are built with EXT_DEBUG enabled in production
• Monitor EPSS and KEV status for any future changes despite current low scores