CVE-2024-57927

What it actually does

Null pointer dereference in nfs_netfs_init_request when netfslib issues a copy-to-cache write without a file pointer, causing nfs_file_open_context to oops; nfs_netfs_free_request also mishandles a NULL context.

Why it matters to the business

Kernel crash and denial of service on NFS clients using netfslib caching; low exploitation probability but high impact on availability for affected kernel versions.

How an attack unfolds

An attacker triggers an NFS read that causes netfslib to perform a subsequent copy-to-cache operation; the kernel path passes a NULL file pointer into nfs_netfs_init_request, dereferencing it and panicking the system.

How to fix it

Upgrade the Linux kernel to version 6.12.10 or apply commit 13a07cc81e2d116cece727a83746c74b87a9d417; rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel version is 6.12.10 or newer; confirm the patch commit is present in the source tree; test NFS cache-copy workloads for absence of oops.

Typical attack path

1. Gain access to trigger NFS reads on a vulnerable client
2. Force netfslib cache-copy path with NULL file context
3. Trigger oops in nfs_file_open_context
4. Cause kernel panic and system reboot or hang

How to detect it

Search kernel logs and dmesg for oops traces containing nfs_netfs_init_request or nfs_file_open_context with NULL pointer dereference; correlate with NFS read activity followed by cache writes.

• nfs_netfs_init_request
• nfs_file_open_context
• NULL file pointer
• copy-to-cache

What your security team should do

• Immediately upgrade all Linux kernels to the fixed version 6.12.10
• Prioritize systems with NFS and netfslib enabled
• Monitor kernel logs for related oops messages during rollout
• Apply vendor backports where available for older supported kernels