CVE-2024-57928

What it actually does

In the Linux kernel netfs code, netfs_read_to_pagecache() failed to consistently decrement nr_outstanding, cancel the subrequest, and exit the loop on errors from prepare_read() or netfs_prepare_read_iterator() in all four code paths, leaving request state inconsistent after ENOMEM or similar failures.

Why it matters to the business

Systems running the affected older kernel builds may experience hangs, resource leaks, or degraded I/O performance during buffered reads under memory pressure; the listed products are long-since EOL with very low remaining deployment footprint.

How an attack unfolds

An attacker would need to induce repeated ENOMEM conditions during netfs buffered read operations on a vulnerable kernel so that the mishandled error paths leave nr_outstanding and subrequest state inconsistent, potentially leading to stalls or crashes; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade spice-server packages on RHEL 6 to version 0:0.12.4-13.el6.1 (all variants) and ensure any Linux kernel trees incorporate commit 88ecdfea1b333de5c51442b45cd549eeadf01852; apply vendor updates immediately on any remaining RHEL 6 systems.

How to confirm the fix worked

Confirm the running kernel contains commit 88ecdfea1b333de5c51442b45cd549eeadf01852 or that spice-server packages report version 0:0.12.4-13.el6.1; re-run buffered read workloads that previously triggered ENOMEM to verify correct error handling and nr_outstanding accounting.

Typical attack path

1. Trigger memory-pressure conditions that cause prepare_read or netfs_prepare_read_iterator to return errors
2. Reach one of the two previously unhandled error paths inside netfs_read_to_pagecache
3. Observe failure to decrement nr_outstanding or cancel the subrequest
4. Continue issuing further I/O until the inconsistent state produces a hang or crash

How to detect it

Review kernel logs for repeated netfs read failures or stalled I/O under memory pressure; no public exploitation artifacts or threat-actor TTPs are known.

What your security team should do

• Inventory all remaining RHEL 6 systems and schedule immediate upgrade or decommissioning
• Apply the listed fixed package versions or kernel commit across the fleet
• Monitor for any remaining netfs read paths that could surface similar unhandled error cases