CVE-2024-56749

What it actually does

Reference count leak in dlm_recover_members when an error occurs (such as -EINTR from ping_members during concurrent recovery), leaving root_list references held and rsbs alive, resulting in memory corruption or resource mismanagement.

Why it matters to the business

Potential system instability, crashes, or resource exhaustion in Linux environments using DLM for clustering or recovery operations, with elevated urgency due to listed threat actor campaigns targeting similar kernel issues despite low EPSS and no KEV status.

How an attack unfolds

Attacker initiates or races recovery operations in the DLM subsystem to force dlm_recover_members into its error path via ping_members returning -EINTR, preventing reference drops on the prior root_list; this inconsistent state can be leveraged in campaigns by espionage and financially motivated actors or during Linux kernel out-of-bounds and uninitialized resource exploitation attempts.

How to fix it

Update affected packages to the listed fixed versions such as qemu (Ubuntu:14.04:LTS) 2.0.0+dfsg-2ubuntu1.30; apply kernel updates addressing the dlm_recover_members refcount handling; verify all downstream dependents are covered given ecosystem prevalence.

How to confirm the fix worked

Confirm package versions match the fixed releases (e.g., qemu 2.0.0+dfsg-2ubuntu1.30 on Ubuntu 14.04 LTS); review DLM recovery code paths and test error injection for dlm_recover_members to ensure references are properly released.

Typical attack path

1. Trigger or race a DLM recovery sequence
2. Cause ping_members to fail with -EINTR from a concurrent recovery
3. Force dlm_recover_members error path without dropping root_list references
4. Exploit resulting refcount inconsistency for memory corruption or further kernel abuse

How to detect it

Search system logs and kernel traces for dlm_recover_members failures, -EINTR returns from ping_members, or repeated recovery triggers; correlate with threat actor patterns involving Linux kernel memory issues in espionage or financial campaigns.

• dlm_recover_members
• ping_members.*-EINTR
• root_list refcount

What your security team should do

• Prioritize patching all affected systems to the specified fixed package versions within the KEV-style urgency window
• Monitor for concurrent recovery triggers in DLM-enabled clusters
• Audit logs for dlm_recover_members errors and -EINTR conditions from ping_members
• Limit exposure of systems running vulnerable DLM code to untrusted recovery events