CVE-2024-57839

What it actually does

Flaw allows ra->size to be reduced by read_pages() such that do_page_cache_ra() is invoked with a negative (interpreted as huge) page count, triggering kernel hangs in NFS readahead paths.

Why it matters to the business

Systems using NFS experience occasional complete hangs, leading to unplanned downtime and degraded file-access performance until the kernel is updated.

How an attack unfolds

An attacker or workload triggers normal NFS readahead operations; the faulty size calculation in the reverted logic produces an invalid page request that deadlocks the kernel readahead code.

How to fix it

Upgrade chromium-browser on Ubuntu 14.04 LTS to version 58.0.3029.81-0ubuntu0.14.04.1172 or later; apply the equivalent upstream kernel revert or updated readahead logic once available.

How to confirm the fix worked

Confirm the package version matches or exceeds the listed fixed release and verify that NFS readahead workloads no longer produce hangs under sustained load.

Typical attack path

1. Initiate NFS file access that exercises readahead
2. Trigger read_pages() shrink of ra->size
3. Invoke do_page_cache_ra() with underflowed page count
4. Kernel enters unrecoverable hang state

How to detect it

Review kernel logs for readahead or page_cache_ra call traces coinciding with NFS hangs; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize kernel and NFS client updates on all systems mounting remote filesystems
• Monitor for readahead-related kernel hangs in production NFS workloads
• Test the fixed chromium-browser package in staging before broad rollout