CVE-2024-41058 is a use-after-free vulnerability identified in the Linux kernel's cachefiles subsystem, specifically within the fscache_withdraw_volume() function. The issue arises due to improper reference count handling of the fscache_volume structure. During the process of withdrawing a volume from the cache, the reference count of the fscache_volume may reach zero, triggering its deallocation via fscache_put_volume(). However, subsequent code paths still attempt to access this freed memory, leading to a slab-use-after-free condition. This was discovered through fault injection stress testing and is evidenced by a KASAN (Kernel Address Sanitizer) error indicating a read of freed memory. The root cause is that the volume is removed from the cache->volumes list before ensuring that no further references exist, and the code does not adequately protect against concurrent access or delayed references. The fix involves using the new helper function fscache_try_get_volume() to safely check and increment the reference count before accessing the volume, ensuring that if the reference count is zero (and the volume is being freed), the code waits for the volume to be fully removed from the cache list before proceeding. This prevents the use-after-free by enforcing proper reference count protection and synchronization. The vulnerability affects Linux kernel versions around 6.8.0 and potentially others using the cachefiles and fscache subsystems. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with the cachefiles feature enabled, which is commonly used to improve filesystem caching performance, especially in environments leveraging networked or distributed filesystems. Exploitation of this use-after-free could lead to kernel crashes (denial of service) or potentially enable local privilege escalation or arbitrary code execution within the kernel context if an attacker can manipulate the cachefiles subsystem. This is particularly concerning for critical infrastructure, cloud service providers, and enterprises relying on Linux-based servers for file storage and caching. The impact on confidentiality, integrity, and availability could be significant if exploited, as kernel-level compromise can lead to full system control. However, exploitation requires local access and triggering specific cachefiles operations, which somewhat limits the attack surface. Still, the vulnerability could be leveraged by malicious insiders or through chained exploits in multi-tenant environments. Given the widespread use of Linux in European data centers, telecommunications, and government systems, the vulnerability could affect a broad range of sectors.

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched. Since no official patch links are provided, monitoring Linux kernel mailing lists and vendor advisories for the fix is critical. In the interim, organizations should audit and potentially disable the cachefiles feature if not essential, as this reduces the attack surface. System administrators should also restrict local access to trusted users only, employ strict access controls, and monitor kernel logs for unusual cachefiles-related errors or crashes. For environments using networked filesystems relying on cachefiles, consider alternative caching mechanisms or enhanced isolation to mitigate risk. Additionally, enabling kernel hardening features such as KASAN in testing environments can help detect similar issues proactively. Regular vulnerability scanning and penetration testing focusing on kernel subsystems can also aid in early detection of exploitation attempts.