CVE-2024-46701 is a vulnerability identified in the Linux kernel's handling of directory reads within the tmpfs filesystem, specifically related to the libfs component managing directory operations. The issue arises after tmpfs directory operations were switched from simple_dir_operations to simple_offset_dir_operations. During rename operations, new directory entries (dentries) are inserted into the destination directory's maple tree structure with keys starting from a new offset value. This offset is then incremented improperly, which causes an infinite loop during directory reads (readdir) when combined with concurrent rename operations. The vulnerability manifests when a process repeatedly reads directory entries and renames files back and forth, causing readdir to loop indefinitely without returning an end-of-directory indication. This behavior was observed in the xfstests generic/736 test case, which simulates creating thousands of files, performing readdir calls, and renaming files repeatedly until the readdir call fails or loops excessively. The root cause is that the directory reading logic does not properly track the last read index, causing it to emit entries repeatedly. The fix implemented mirrors a previous patch for btrfs that records the last_index when opening a directory and prevents emitting entries with indices greater than or equal to this last_index. The file's private_data structure is used to track this last_index, which is updated upon seeking the directory file, but only when the offset is reset to zero. This correction prevents infinite loops by ensuring directory reads terminate correctly after the last entry is read. No known exploits are reported in the wild, and the vulnerability affects Linux kernel versions identified by the commit hash a2e459555c5f9da3e619b7e47a63f98574dc75f1. No CVSS score has been assigned yet.

For European organizations, this vulnerability could lead to denial of service (DoS) conditions on systems using tmpfs, a common in-memory filesystem used for temporary storage. The infinite loop in directory reads can cause processes that rely on reading directory contents to hang or consume excessive CPU resources, potentially degrading system performance or causing application failures. This is particularly critical for servers and infrastructure relying on tmpfs for caching, temporary file storage, or runtime data, including cloud environments, container platforms, and embedded Linux devices. While the vulnerability does not directly lead to privilege escalation or data leakage, the resulting DoS could disrupt critical services, impacting availability and operational continuity. Systems heavily utilizing tmpfs for high-frequency file operations or automated scripts performing rename and directory read cycles are at higher risk. The absence of known exploits reduces immediate threat, but the vulnerability's presence in the Linux kernel means that unpatched systems remain vulnerable to potential future exploitation or accidental triggering by benign workloads.

European organizations should prioritize updating their Linux kernel to versions that include the patch fixing CVE-2024-46701. Since the vulnerability relates to tmpfs directory operations, kernel updates from trusted Linux distributions should be applied promptly. For environments where immediate patching is not feasible, administrators should monitor and limit workloads that perform intensive rename and readdir operations on tmpfs directories, especially scripts or applications that create and rename large numbers of files rapidly. Implementing resource limits (e.g., CPU and I/O throttling) on processes interacting heavily with tmpfs can reduce the risk of system resource exhaustion. Additionally, monitoring system logs and performance metrics for unusual CPU spikes or hangs related to directory operations can help detect attempts to trigger this vulnerability. Containerized environments should ensure base images use updated kernels and avoid tmpfs misuse in application logic. Finally, security teams should maintain awareness of kernel updates and advisories from Linux vendors and test patches in staging environments before production deployment to avoid regressions.