CVE-2024-41075 (GCVE-0-2024-41075)

Vulnerability from cvelistv5 – Published: 2024-07-29 14:57 – Updated: 2026-08-05 11:35
VLAI
Title
cachefiles: add consistency check for copen/cread
Summary
In the Linux kernel, the following vulnerability has been resolved: cachefiles: add consistency check for copen/cread This prevents malicious processes from completing random copen/cread requests and crashing the system. Added checks are listed below: * Generic, copen can only complete open requests, and cread can only complete read requests. * For copen, ondemand_id must not be 0, because this indicates that the request has not been read by the daemon. * For cread, the object corresponding to fd and req should be the same.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:21 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9032b6e8589f269743984aac53e82e4835be16dc , < 3b744884c0431b5a62c92900e64bfd0ed61e8e2a (git)
Affected: 9032b6e8589f269743984aac53e82e4835be16dc , < 36d845ccd7bf527110a65fe953886a176c209539 (git)
Affected: 9032b6e8589f269743984aac53e82e4835be16dc , < 8aaa6c5dd2940ab934d6cd296175f43dbb32b34a (git)
Affected: 9032b6e8589f269743984aac53e82e4835be16dc , < a26dc49df37e996876f50a0210039b2d211fdd6f (git)
Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.101 , ≤ 6.1.* (semver)
Unaffected: 6.6.42 , ≤ 6.6.* (semver)
Unaffected: 6.9.11 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:30.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:21:24.232426Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:00.106Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/ondemand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b744884c0431b5a62c92900e64bfd0ed61e8e2a",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            },
            {
              "lessThan": "36d845ccd7bf527110a65fe953886a176c209539",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            },
            {
              "lessThan": "8aaa6c5dd2940ab934d6cd296175f43dbb32b34a",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            },
            {
              "lessThan": "a26dc49df37e996876f50a0210039b2d211fdd6f",
              "status": "affected",
              "version": "9032b6e8589f269743984aac53e82e4835be16dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cachefiles/ondemand.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.101",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.42",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.11",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: add consistency check for copen/cread\n\nThis prevents malicious processes from completing random copen/cread\nrequests and crashing the system. Added checks are listed below:\n\n  * Generic, copen can only complete open requests, and cread can only\n    complete read requests.\n  * For copen, ondemand_id must not be 0, because this indicates that the\n    request has not been read by the daemon.\n  * For cread, the object corresponding to fd and req should be the same."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to issue `ioctl(CACHEFILES_IOC_READ_COMPLETE)` on the anonymous `[cachefiles]` file descriptor or `write()` the `copen` command to `/dev/cachefiles`. There is no network-facing path into `fs/cachefiles/ondemand.c`.\nAC:L - Request IDs are the lowest free xarray indices starting at 0, so they are trivially enumerable, and the attacker can generate requests on demand by reading files from the erofs-over-fscache mount, controlling both sides of any timing window. No condition outside the attacker\u0027s control is needed.\nPR:L - `cachefiles_ondemand_fd_ioctl()` performs no capability check at all \u2014 mere possession of the anon fd suffices \u2014 and that fd is created with `get_unused_fd_flags(O_WRONLY)` without `O_CLOEXEC`, so it is inherited across `exec()` and is routinely passed to unprivileged helper processes in on-demand cache/container-image deployments.\nUI:N - No victim action is required; the cachefiles daemon and the fscache/erofs mount are already-running system state, and the attacker itself generates the OPEN/READ requests it then maliciously completes.\nS:U - The corrupted request and object state, the truncation of backing cache files, and the resulting crashes all remain within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Completing a READ request out of band makes the netfs/erofs path treat an unpopulated range as successfully fetched, exposing raw backing cache-file contents (stale data from culled/reused cache objects) to the reader. The corrupted request/object lifetimes in this exact code region are the same class that produced KASAN slab-use-after-free reads in the sibling fixes.\nI:H - `copen` on an arbitrary request lets the attacker set any object\u0027s `cookie-\u003eobject_size`, which drives `vfs_truncate()` of the backing cache file and the on-disk coherency xattr, and lets erofs-over-fscache mounts serve wrong or unfetched content \u2014 corrupting data and executables read from container images.\nA:H - The commit exists specifically to stop malicious processes \"crashing the system\"; completing requests out of band leaves objects marked open with `ondemand_id == 0` and no anon fd, so readers block permanently in uninterruptible `wait_for_completion()` (hung task / unkillable D-state), and leaked anon fds pin cookies so later mounts hang as well."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:13.241Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539"
        },
        {
          "url": "https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f"
        }
      ],
      "title": "cachefiles: add consistency check for copen/cread",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41075",
    "datePublished": "2024-07-29T14:57:34.891Z",
    "dateReserved": "2024-07-12T12:17:45.632Z",
    "dateUpdated": "2026-08-05T11:35:13.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-41075",
      "date": "2026-08-14",
      "epss": "0.0022",
      "percentile": "0.12642"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: add consistency check for copen/cread\\n\\nThis prevents malicious processes from completing random copen/cread\\nrequests and crashing the system. Added checks are listed below:\\n\\n  * Generic, copen can only complete open requests, and cread can only\\n    complete read requests.\\n  * For copen, ondemand_id must not be 0, because this indicates that the\\n    request has not been read by the daemon.\\n  * For cread, the object corresponding to fd and req should be the same.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: archivos de cach\\u00e9: agregue verificaci\\u00f3n de coherencia para copen/cread. Esto evita que procesos maliciosos completen solicitudes aleatorias de copen/cread y bloqueen el sistema. Las comprobaciones agregadas se enumeran a continuaci\\u00f3n: * Gen\\u00e9rico, copen solo puede completar solicitudes abiertas y cread solo puede completar solicitudes de lectura. * Para copen, ondemand_id no debe ser 0, porque esto indica que el daemon no ha le\\u00eddo la solicitud. * Para cread, el objeto correspondiente a fd y req debe ser el mismo.\"}]",
      "id": "CVE-2024-41075",
      "lastModified": "2024-11-21T09:32:11.667",
      "published": "2024-07-29T15:15:15.163",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41075\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T15:15:15.163\",\"lastModified\":\"2026-08-04T11:19:26.817\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: add consistency check for copen/cread\\n\\nThis prevents malicious processes from completing random copen/cread\\nrequests and crashing the system. Added checks are listed below:\\n\\n  * Generic, copen can only complete open requests, and cread can only\\n    complete read requests.\\n  * For copen, ondemand_id must not be 0, because this indicates that the\\n    request has not been read by the daemon.\\n  * For cread, the object corresponding to fd and req should be the same.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: archivos de cach\u00e9: agregue verificaci\u00f3n de coherencia para copen/cread. Esto evita que procesos maliciosos completen solicitudes aleatorias de copen/cread y bloqueen el sistema. Las comprobaciones agregadas se enumeran a continuaci\u00f3n: * Gen\u00e9rico, copen solo puede completar solicitudes abiertas y cread solo puede completar solicitudes de lectura. * Para copen, ondemand_id no debe ser 0, porque esto indica que el daemon no ha le\u00eddo la solicitud. * Para cread, el objeto correspondiente a fd y req debe ser el mismo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/cachefiles/ondemand.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9032b6e8589f269743984aac53e82e4835be16dc\",\"lessThan\":\"3b744884c0431b5a62c92900e64bfd0ed61e8e2a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9032b6e8589f269743984aac53e82e4835be16dc\",\"lessThan\":\"36d845ccd7bf527110a65fe953886a176c209539\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9032b6e8589f269743984aac53e82e4835be16dc\",\"lessThan\":\"8aaa6c5dd2940ab934d6cd296175f43dbb32b34a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9032b6e8589f269743984aac53e82e4835be16dc\",\"lessThan\":\"a26dc49df37e996876f50a0210039b2d211fdd6f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/cachefiles/ondemand.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.101\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.42\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.11\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:21:24.232426Z\",\"id\":\"CVE-2024-41075\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.1.101\",\"matchCriteriaId\":\"3555E9DB-19F5-4B47-ACF3-8DD9DB619A2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.42\",\"matchCriteriaId\":\"972274A2-D688-4C37-BE42-689B58B4C225\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.11\",\"matchCriteriaId\":\"01E300B3-8B39-4A2D-8B03-4631433D3915\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:43:25+00:00",
      "cve": "CVE-2024-41075",
      "id": "CVE-2024-41075",
      "initial_release_date": "2024-07-29T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cachefiles: add consistency check for copen/cread",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-41075.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:55:16Z",
      "cve": "CVE-2024-41075",
      "id": "CVE-2024-41075",
      "initial_release_date": "2024-08-06T02:01:18Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "261",
      "product_status:recommended": "360",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-41075",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-41075.json",
      "version": "57"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:46:52.518Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41075\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:21:24.232426Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:20.092Z\"}}], \"cna\": {\"title\": \"cachefiles: add consistency check for copen/cread\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9032b6e8589f269743984aac53e82e4835be16dc\", \"lessThan\": \"3b744884c0431b5a62c92900e64bfd0ed61e8e2a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9032b6e8589f269743984aac53e82e4835be16dc\", \"lessThan\": \"36d845ccd7bf527110a65fe953886a176c209539\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9032b6e8589f269743984aac53e82e4835be16dc\", \"lessThan\": \"8aaa6c5dd2940ab934d6cd296175f43dbb32b34a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9032b6e8589f269743984aac53e82e4835be16dc\", \"lessThan\": \"a26dc49df37e996876f50a0210039b2d211fdd6f\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/cachefiles/ondemand.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.101\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.42\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/cachefiles/ondemand.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a\"}, {\"url\": \"https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539\"}, {\"url\": \"https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a\"}, {\"url\": \"https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncachefiles: add consistency check for copen/cread\\n\\nThis prevents malicious processes from completing random copen/cread\\nrequests and crashing the system. Added checks are listed below:\\n\\n  * Generic, copen can only complete open requests, and cread can only\\n    complete read requests.\\n  * For copen, ondemand_id must not be 0, because this indicates that the\\n    request has not been read by the daemon.\\n  * For cread, the object corresponding to fd and req should be the same.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.101\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.42\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.11\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-21T09:12:55.086Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41075\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-21T09:12:55.086Z\", \"dateReserved\": \"2024-07-12T12:17:45.632Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T14:57:34.891Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.