CVE-2024-50064

What it actually does

The vulnerability is a memory leak in the Linux kernel zram driver: secondary compression algorithm names are not freed with kfree() on device reset when multi-stream compression is configured.

Why it matters to the business

Systems relying on zram for swap or compressed RAM may experience gradual memory exhaustion after repeated device resets, leading to performance degradation, instability, or the need for unplanned reboots; high ecosystem prevalence of the Linux kernel increases exposure across servers and embedded devices.

How an attack unfolds

An attacker with local access configures a zram device to use multiple compression streams, then repeatedly resets the device; each reset leaks memory because secondary algorithm names are not released. Similar Linux kernel resource issues have been targeted in 2024 zero-day campaigns by espionage and financially motivated actors.

How to fix it

Upgrade the Linux kernel to a version containing commit 6272936fd242ca1f784c3e21596dfb3859dff276 or later; for Rocky Linux 8 systems apply libreoffice package update 1:6.4.7.2-10.el8 or newer kernel packages that include the fix.

How to confirm the fix worked

Verify the running kernel contains commit 6272936fd242ca1f784c3e21596dfb3859dff276; after applying the update, confirm that repeated zram resets no longer increase unreclaimed memory via slabinfo or kmemleak checks.

Typical attack path

1. Obtain local access or privileges to manage zram devices
2. Enable multi-stream compression on a zram device
3. Trigger repeated device resets
4. Observe cumulative memory consumption until system impact occurs

How to detect it

Correlate zram device reset events in kernel logs with steady increases in slab memory usage; review dmesg or /proc/slabinfo for growth in algorithm name allocations on multi-stream zram devices.

What your security team should do

• Prioritize kernel updates on all systems using zram within the CISA remediation window if applicable
• Disable multi-stream zram configurations where not required until patches are deployed
• Monitor memory usage metrics on zram-enabled hosts for unexpected growth after resets
• Review and restrict unprivileged access to zram configuration interfaces