CVE-2024-56549

What it actually does

NULL pointer dereference in cachefiles object->file when an ondemand fd write occurs concurrently with cookie withdrawal and fput during umount, caused by mismatched fd and object->file lifetimes.

Why it matters to the business

Kernel panic or denial of service on systems using cachefiles ondemand mode, potentially disrupting file caching services and requiring reboots; low exploit probability but affects Linux kernel deployments.

How an attack unfolds

An attacker with local access triggers the race by performing a write to an ondemand fd while a concurrent umount path calls fscache_cookie_state_machine, cachefiles_withdraw_cookie, and sets object->file to NULL, leading to dereference in __cachefiles_write.

How to fix it

Update to Linux kernel commit d6bba3ece960129a553d4b16f1b00c884dc0993a or later stable releases that add an extra reference count to object->file before write/llseek operations.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; test ondemand mode under concurrent write and umount workloads to verify no NULL dereference occurs.

Typical attack path

1. Obtain local access on a system using cachefiles ondemand mode
2. Initiate a write operation via cachefiles_ondemand_fd_write_iter
3. Trigger concurrent umount that executes cachefiles_clean_up_object and fput(object->file)
4. Cause NULL dereference when __cachefiles_write uses the now-NULL file pointer

How to detect it

Inspect kernel logs for cachefiles NULL pointer dereference oops messages; correlate timestamps of write operations with umount events in audit or system logs.

What your security team should do

• Apply the kernel patch immediately on systems using cachefiles ondemand mode
• Monitor for kernel oops or panic logs related to cachefiles
• Disable ondemand mode if patching is delayed and functionality permits
• Review EPSS trend and threat actor reports for any increase in Linux kernel exploitation