CVE-2024-57952

What it actually does

The vulnerability causes directory entries to vanish from readdir/getdents output on 32-bit systems once the offset allocator wraps, because offset_readdir incorrectly compares dentry offsets as monotonic values instead of opaque cookies, hiding entries whose offsets exceed the wrapped next_offset.

Why it matters to the business

Applications relying on complete directory enumeration may miss files or subdirectories persistently, leading to incomplete backups, failed searches, and operational issues primarily on 32-bit Linux deployments.

How an attack unfolds

No active attacker exploitation is involved; the issue surfaces naturally after sufficient directory operations cause the offset allocator to wrap on 32-bit platforms, at which point existing entries stop appearing in listings while remaining accessible by direct lookup.

How to fix it

Apply the fix by upgrading the Linux kernel to a version containing commit 9e9e710f68bac49bd9b587823c077d06363440e0; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the kernel source includes commit 9e9e710f68bac49bd9b587823c077d06363440e0, then exercise directory operations over time on 32-bit builds to confirm entries remain visible after offset wrap.

Typical attack path

1. Run a 32-bit Linux kernel using the simple_offset directory mechanism
2. Perform repeated directory creation and enumeration until the offset allocator wraps
3. Observe that previously created entries no longer appear in readdir output

How to detect it

Review application logs and user reports for missing directory entries on 32-bit systems; correlate with prolonged uptime and high directory churn rates.

What your security team should do

• Prioritize upgrade on all 32-bit Linux systems within the next maintenance window
• Test directory enumeration workloads on representative 32-bit hardware before broad rollout
• Document the regression timeline for any LTS kernels still using the reverted change