CVE-2024-41058— cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于在使用fscache_withdraw_volume函数时，fscache_volume可能已经被释放，但引用计数可能为0，导致释放后重用问题。
Affected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35< 90f17e47f1e209c6a3c92a1d038a0a80c95c460e |
affected |
fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35< 9dd7f5663899ea13a6a73216106d9c13c37453e3 |
affected | ||
fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35< 38b88d544216f806d93a273a62ff8ebe82254003 |
affected | ||
fe2140e2f57fef8562e0f9b7cd447d2b08dc2f35< 522018a0de6b6fcce60c04f86dfc5f0e4b6a1b36 |
affected | ||
5.17 |
affected | ||
< 5.17 |
unaffected | ||
6.1.101≤ 6.1.* |
unaffected | ||
6.6.42≤ 6.6.* |
unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-41058
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
We got the following issue in our fault injection stress test:
==================================================================
BUG: KASAN: slab-use-after-free in fscache_withdraw_volume+0x2e1/0x370
Read of size 4 at addr ffff88810680be08 by task ondemand-04-dae/5798
CPU: 0 PID: 5798 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #565
Call Trace:
kasan_check_range+0xf6/0x1b0
fscache_withdraw_volume+0x2e1/0x370
cachefiles_withdraw_volume+0x31/0x50
cachefiles_withdraw_cache+0x3ad/0x900
cachefiles_put_unbind_pincount+0x1f6/0x250
cachefiles_daemon_release+0x13b/0x290
__fput+0x204/0xa00
task_work_run+0x139/0x230
Allocated by task 5820:
__kmalloc+0x1df/0x4b0
fscache_alloc_volume+0x70/0x600
__fscache_acquire_volume+0x1c/0x610
erofs_fscache_register_volume+0x96/0x1a0
erofs_fscache_register_fs+0x49a/0x690
erofs_fc_fill_super+0x6c0/0xcc0
vfs_get_super+0xa9/0x140
vfs_get_tree+0x8e/0x300
do_new_mount+0x28c/0x580
[...]
Freed by task 5820:
kfree+0xf1/0x2c0
fscache_put_volume.part.0+0x5cb/0x9e0
erofs_fscache_unregister_fs+0x157/0x1b0
erofs_kill_sb+0xd9/0x1c0
deactivate_locked_super+0xa3/0x100
vfs_get_super+0x105/0x140
vfs_get_tree+0x8e/0x300
do_new_mount+0x28c/0x580
[...]
==================================================================
Following is the process that triggers the issue:
mount failed | daemon exit
------------------------------------------------------------
deactivate_locked_super cachefiles_daemon_release
erofs_kill_sb
erofs_fscache_unregister_fs
fscache_relinquish_volume
__fscache_relinquish_volume
fscache_put_volume(fscache_volume, fscache_volume_put_relinquish)
zero = __refcount_dec_and_test(&fscache_volume->ref, &ref);
cachefiles_put_unbind_pincount
cachefiles_daemon_unbind
cachefiles_withdraw_cache
cachefiles_withdraw_volumes
list_del_init(&volume->cache_link)
fscache_free_volume(fscache_volume)
cache->ops->free_volume
cachefiles_free_volume
list_del_init(&cachefiles_volume->cache_link);
kfree(fscache_volume)
cachefiles_withdraw_volume
fscache_withdraw_volume
fscache_volume->n_accesses
// fscache_volume UAF !!!
The fscache_volume in cache->volumes must not have been freed yet, but its
reference count may be 0. So use the new fscache_try_get_volume() helper
function try to get its reference count.
If the reference count of fscache_volume is 0, fscache_put_volume() is
freeing it, so wait for it to be removed from cache->volumes.
If its reference count is not 0, call cachefiles_withdraw_volume() with
reference count protection to avoid the above issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于在使用fscache_withdraw_volume函数时，fscache_volume可能已经被释放，但引用计数可能为0，导致释放后重用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-41058
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-41058
请登录查看更多情报信息。
Other References for CVE-2024-41058 (4)
Same Patch Batch · Linux · 2024-07-29 · 121 CVEs total
| CVE-2024-41040 | 9.8 CRITICAL | net/sched: Fix UAF when resolving a clash |
| CVE-2024-41081 | 9.8 CRITICAL | ila: block BH in ila_output() |
| CVE-2024-41073 | 9.8 CRITICAL | nvme: avoid double free special payload |
| CVE-2024-41091 | 8.8 HIGH | tun: add missing verification for short frame |
| CVE-2024-41090 | 8.8 HIGH | tap: add missing verification for short frame |
| CVE-2024-41046 | 8.8 HIGH | net: ethernet: lantiq_etop: fix double free in detach |
| CVE-2024-42083 | 8.8 HIGH | ionic: fix kernel panic due to multi-buffer handling |
| CVE-2024-41062 | 8.8 HIGH | bluetooth/l2cap: sync sock recv cb and release |
| CVE-2024-41045 | 7.8 HIGH | bpf: Defer work in bpf_timer_cancel_and_free |
| CVE-2024-41096 | 7.8 HIGH | PCI/MSI: Fix UAF in msi_capability_init |
| CVE-2024-41049 | 7.8 HIGH | filelock: fix potential use-after-free in posix_lock_inode |
| CVE-2024-41051 | 7.8 HIGH | cachefiles: wait for ondemand_object_worker to finish when dropping object |
| CVE-2024-41057 | 7.8 HIGH | cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() |
| CVE-2024-41060 | 7.8 HIGH | drm/radeon: check bo_va->bo is non-NULL before using it |
| CVE-2024-41059 | 7.8 HIGH | hfsplus: fix uninit-value in copy_name |
| CVE-2024-41064 | 7.8 HIGH | powerpc/eeh: avoid possible crash when edev->pdev changes |
| CVE-2024-42075 | 7.8 HIGH | bpf: Fix remap of arena. |
| CVE-2024-42066 | 7.8 HIGH | drm/xe: Fix potential integer overflow in page size calculation |
| CVE-2024-42064 | 7.8 HIGH | drm/amd/display: Skip pipe if the pipe idx not set properly |
| CVE-2024-41086 | 7.8 HIGH | bcachefs: Fix sb_field_downgrade validation |
Showing top 20 of 121 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
Same vendor: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
V. Comments for CVE-2024-41058
No comments yet