CVE-2024-41051 is a use-after-free vulnerability in the Linux kernel's cachefiles subsystem. The issue arises during the handling of ondemand_object_worker(), which is queued to re-open a cachefiles_object. The vulnerability occurs because the cachefiles_object is not pinned when ondemand_object_worker() is queued. If the underlying erofs filesystem is unmounted and the pending read request completes, the cachefiles_object may be freed. Subsequently, if ondemand_object_worker() executes after the object has been freed, it accesses memory that has been deallocated, leading to a use-after-free condition. This can cause undefined behavior including potential kernel crashes or memory corruption. The root cause is a race condition between the completion of read requests and the lifecycle management of cachefiles_object during filesystem unmount. The fix involves ensuring that when dropping an object, the ondemand_object_worker() is either canceled or waited upon using cancel_work_sync(), preventing it from running after the object is freed. This vulnerability affects specific Linux kernel versions identified by their commit hashes and is related to the cachefiles and erofs filesystems interaction. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running affected Linux kernel versions with cachefiles and erofs filesystems in use. Exploitation could lead to kernel crashes (denial of service) or potentially allow an attacker to execute arbitrary code in kernel context if the use-after-free is leveraged effectively. This could compromise system integrity and availability, impacting critical infrastructure, servers, and embedded devices relying on Linux. Given the widespread use of Linux in European enterprises, cloud providers, and government agencies, the vulnerability could disrupt services or be a foothold for privilege escalation attacks. The impact is more pronounced in environments where erofs is mounted and cachefiles is active, such as caching proxy servers or systems using cachefiles for performance optimization. Although no exploits are known yet, the vulnerability's nature makes it a candidate for future exploitation, especially in targeted attacks against high-value European targets.

European organizations should promptly update their Linux kernels to versions where this vulnerability is patched. Specifically, ensure that the kernel includes the fix that uses cancel_work_sync() to safely cancel ondemand_object_worker() when dropping cachefiles objects. System administrators should audit their use of cachefiles and erofs filesystems and consider disabling cachefiles if not required. For critical systems, implement kernel live patching if available to minimize downtime. Additionally, monitor system logs for unusual kernel warnings or crashes related to cachefiles or ondemand_object_worker. Employ strict access controls to limit who can mount/unmount filesystems and interact with cachefiles. Finally, maintain robust backup and recovery procedures to mitigate potential denial of service impacts.