CVE-2024-50272

What it actually does

Missing bounds check in filemap_read() allows ki_pos near filesystem limit combined with iterator count to overflow, causing the function to enter an infinite loop instead of returning.

Why it matters to the business

Systems may experience unrecoverable CPU spin on affected read paths, leading to denial of service, degraded performance on NFS loopback mounts, and potential operational disruption until the kernel is updated.

How an attack unfolds

An attacker supplies an iocb with ki_pos near the filesystem upper limit and an iterator whose count triggers overflow; repeated calls to filemap_read() then loop indefinitely. This was observed during xfstests generic/525 with localio NFS optimizations.

How to fix it

Update the Linux kernel to the commit 69973b830859bc6529a7a0468ba0d80ee5117826 or later release that contains the bounds-check fix in filemap_read().

How to confirm the fix worked

Confirm the running kernel contains commit 69973b830859bc6529a7a0468ba0d80ee5117826; re-execute xfstests generic/525 with localio to verify the loop no longer occurs.

Typical attack path

1. Identify a writable file on a vulnerable Linux filesystem
2. Craft an iocb structure with ki_pos close to the maximum offset
3. Prepare an iterator with a count value that overflows the remaining space
4. Issue the read operation that reaches filemap_read()
5. Trigger repeated invocations to sustain the infinite loop and consume CPU

How to detect it

Inspect kernel logs and performance traces for repeated or prolonged execution inside filemap_read(); correlate with processes performing large reads near filesystem boundaries on NFS mounts.

What your security team should do

• Apply the kernel update containing commit 69973b830859bc6529a7a0468ba0d80ee5117826 as highest priority
• Monitor for high sustained CPU in filemap_read paths on production systems
• Test NFS loopback configurations after patching to ensure stability