CVE-2024-56630

What it actually does

Failure to release an inode reference via iput() after new_inode() succeeds but dquot_initialize() fails, leaving busy inodes after ocfs2 unmount.

Why it matters to the business

Potential unmount failures and gradual resource leakage in ocfs2-based storage environments, increasing maintenance overhead; low immediate risk given minimal EPSS and absence from KEV.

How an attack unfolds

An attacker mounts an ocfs2 filesystem and forces the error path after inode allocation by inducing dquot_initialize failure; this is referenced in broad 2024 Linux kernel exploitation campaigns by espionage and financially motivated actors though no confirmed active use of this specific flaw.

How to fix it

Apply the upstream fix in commit 911fcc95b530615b484e8920741fc5e4bc4e684a; for listed distributions upgrade ffmpeg packages to 7:3.4.2-2 (Ubuntu 18.04), 7:4.2.2-1ubuntu1 (Ubuntu 20.04), or 7:4.4-6ubuntu5 (Ubuntu 22.04) where applicable and rebuild or patch affected kernels.

How to confirm the fix worked

Confirm the iput() call is present after dquot_initialize error paths in ocfs2 inode initialization code; test by injecting dquot_initialize failures and verifying clean unmount with no busy inode warnings.

Typical attack path

1. Mount ocfs2 filesystem
2. Trigger dquot_initialize failure after successful new_inode allocation
3. Unmount filesystem to observe leaked busy inodes
4. Repeat to accumulate resource pressure

How to detect it

Inspect kernel logs for messages about busy inodes remaining after ocfs2 unmount operations; correlate with any dquot or quota initialization error events around the same timeframe.

What your security team should do

• Prioritize kernel updates on systems using ocfs2
• Review mount/unmount logs for busy inode reports
• Limit ocfs2 usage to trusted environments until patched
• Track EPSS and KEV updates for any change in exploitability