PT-2024-29151 · Linux+5 · Linux Kernel+5

Published

2024-05-22

·

Updated

2025-09-17

·

CVE-2024-40935

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description The issue occurs in the Linux kernel when the daemon is processing an open request in ondemand mode and the kernel flags the cache as CACHEFILES DEAD. The cachefiles daemon write() function will always return -EIO, preventing the daemon from passing the copen to the kernel. This triggers a hung task in the kernel process waiting for the copen. Since the DEAD state is irreversible, it can only be exited by closing /dev/cachefiles. To avoid this, all requests are flushed after setting CACHEFILES DEAD in ondemand mode. It is possible to read some cached data before closing the fd of /dev/cachefiles. This fix relies on a patch that adds reference counting to the req; otherwise, it may result in a use-after-free (UAF) condition.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2025-03398
CVE-2024-40935
DLA-4008-1
DSA-5731-1
OESA-2024-1960
OPENSUSE-SU-2024_2947-1
SUSE-SU-2024:2802-1
SUSE-SU-2024:2894-1
SUSE-SU-2024:2896-1
SUSE-SU-2024:2939-1
SUSE-SU-2024:2947-1
SUSE-SU-2024:2973-1
SUSE-SU-2025:20008-1
SUSE-SU-2025:20028-1
USN-6999-1
USN-6999-2
USN-7004-1
USN-7005-1
USN-7005-2
USN-7008-1
USN-7029-1

Affected Products

Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu