CVE-2024-53090

What it actually does

Lock recursion occurs in afs_wake_up_async_call when called from AF_RXRPC while holding notify_lock; taking an extra ref on an already-queued afs_call leads to afs_put_call invoking rxrpc_kernel_shutdown_call which attempts the same lock, producing spinlock recursion and kernel oops.

Why it matters to the business

Systems using the affected kernel and Samba may experience unexpected crashes or instability during AFS/RXRPC operations, increasing downtime risk and requiring urgent patching especially given listed threat actor campaigns targeting kernel issues.

How an attack unfolds

An attacker triggers AFS async call paths that invoke afs_wake_up_async_call under the notify_lock; the resulting recursion can be reached via crafted RXRPC packet handling, potentially leading to denial of service, though the condition is uncommon and no public exploit code is known.

How to fix it

Upgrade to fixed Samba package versions: 2:4.3.11+dfsg-0ubuntu0.14.04.1 (Ubuntu 14.04 LTS) or 2:4.3.11+dfsg-0ubuntu0.16.04.1 (Ubuntu 16.04 LTS) which incorporate the kernel fix deferring the operation to a workqueue; apply kernel updates containing the AFS lock recursion resolution.

How to confirm the fix worked

Confirm kernel and Samba package versions match the listed fixed releases; monitor for absence of spinlock recursion BUG messages in dmesg involving rxrpc_notify_socket and afs_put_call; test AFS workloads that previously exercised async call paths.

Typical attack path

1. Establish RXRPC connection to trigger AFS call handling
2. Send crafted data packets that cause afs_wake_up_async_call while notify_lock is held
3. Force afs_call to already be queued so ref counting leads to put path
4. Induce rxrpc_kernel_shutdown_call to re-acquire the lock and trigger recursion

How to detect it

Search kernel logs and dmesg for spinlock recursion BUG reports involving krxrpcio, rxrpc_kernel_shutdown_call, afs_put_call, and notify_lock; inspect rxrpc_input paths for unexpected call shutdown sequences; correlate with any AFS workload spikes.

• BUG: spinlock recursion on CPU
• rxrpc_kernel_shutdown_call+0x83/0xb0
• afs_put_call+0xd7/0x180
• rxrpc_notify_socket+0xa0/0x190

What your security team should do

• Prioritize patching all affected Ubuntu systems to the exact fixed Samba versions within the next maintenance window
• Review kernel logs for any prior spinlock recursion events matching the reported oops pattern
• Monitor EPSS and threat actor reports for changes in exploit maturity given the listed espionage and ransomware campaigns
• Apply defense-in-depth by restricting RXRPC/AFS exposure where feasible