CVE-2024-50065

What it actually does

The ntfs_d_hash function performs directory name hashing under RCU-walk and calls __get_name() with GFP_KERNEL, allowing the allocator to sleep under memory pressure and violate RCU non-blocking requirements, which can trigger scheduling while atomic or deadlock conditions.

Why it matters to the business

Linux systems using the ntfs3 driver may experience unexpected crashes, hangs, or filesystem instability during directory operations under memory pressure, increasing operational risk and potential downtime for organizations relying on NTFS volumes.

How an attack unfolds

An attacker with local access or the ability to trigger directory lookups on an ntfs3-mounted volume induces memory pressure while a process performs d_hash operations; the GFP_KERNEL allocation sleeps, violating RCU constraints and leading to kernel instability that could be leveraged in broader exploitation campaigns by espionage or financially motivated actors targeting Linux kernel flaws.

How to fix it

Upgrade the Linux kernel to version 6.6.57 or later, or apply the commit c556e72cea2a1131ae418be017dd6fc76fffe2fb. For Rocky Linux 8 systems, update webkit2gtk3 to 0:2.34.6-1.el8 or newer. Reboot after kernel updates and verify the ntfs3 driver no longer uses blocking allocations in d_hash.

How to confirm the fix worked

Confirm the running kernel version is at or above the fixed release, review the ntfs3 source for GFP_NOWAIT in ntfs_d_hash, and perform stress tests involving directory operations under memory pressure to ensure no sleeping occurs under RCU-walk.

Typical attack path

1. Mount an NTFS volume using the ntfs3 driver.
2. Trigger repeated directory enumeration or file operations to invoke ntfs_d_hash under RCU-walk.
3. Simultaneously induce memory pressure to force the GFP_KERNEL allocation in __get_name() to sleep.
4. Cause RCU violation leading to kernel panic, hang, or exploitable scheduler state.

How to detect it

Review kernel logs for RCU, scheduling while atomic, or ntfs3 related warnings during directory operations; correlate with memory pressure events and process activity on NTFS mounts. Threat actor mentions of Linux kernel resource and bounds issues can guide broader hunting for similar patterns.

What your security team should do

• Prioritize kernel upgrades on all systems exposing NTFS volumes via ntfs3, especially those reachable by untrusted users.
• Monitor EPSS and threat actor activity for any increase in Linux kernel exploitation and adjust patching cadence accordingly.
• Restrict unprivileged access to ntfs3 mounts until patches are applied.