CVE-2024-50229

What it actually does

Potential deadlock in nilfs2 due to GFP_KERNEL flags on newly created symlinks allowing memory reclamation to invoke filesystem operations while ns_segctor_sem is held, creating circular lock dependencies with s_writers and fs_reclaim.

Why it matters to the business

Local users can trigger system hangs or crashes on nilfs2 filesystems, leading to denial of service and operational disruption; widespread kernel deployments increase exposure across servers and devices.

How an attack unfolds

An attacker with local access creates a symlink on a nilfs2 filesystem, triggering page_symlink() with GFP_KERNEL flags; subsequent memory pressure causes reclamation that calls nilfs_evict_inode() or nilfs_dirty_inode() while the segment constructor semaphore is held, resulting in deadlock.

How to fix it

Upgrade to a kernel containing the fix that drops __GFP_FS from page cache GFP flags during nilfs_symlink() creation, matching the approach used in nilfs_new_inode() and __nilfs_read_inode().

How to confirm the fix worked

Confirm kernel version includes the nilfs2 symlink GFP flag correction; test symlink creation under memory pressure without deadlock; review commit 21fc61c73c39 effects and nilfs2 source for inode_nohighmem() handling.

Typical attack path

1. Obtain local user access on a system using nilfs2
2. Create a symbolic link in a nilfs2-mounted filesystem
3. Induce memory pressure to trigger reclamation involving the FS layer
4. Trigger deadlock via inode operations while ns_segctor_sem is acquired

How to detect it

Review kernel logs for deadlock warnings or hung task reports involving nilfs_segctor_sem and memory reclaim; inspect process traces showing page_symlink() and nilfs_evict_inode() contention on nilfs2 mounts.

What your security team should do

• Prioritize kernel updates on all nilfs2-using systems due to local DoS risk
• Monitor for local symlink creation patterns on nilfs2 mounts
• Apply filesystem-specific mitigations such as avoiding nilfs2 for untrusted workloads until patched