CVE-2024-50250 is a vulnerability in the Linux kernel's fsdax subsystem, specifically within the dax_unshare_iter function. The issue arises because the function does not correctly handle unaligned positions and lengths when copying data blocks from source memory mappings (srcmap) to iomaps. The dax_iomap_direct_access function always returns a pointer to the start of a kmapped fsdax page regardless of the position argument, which can be in the middle of the page. This misalignment causes the data address and source address to not correspond to the same byte in the file, leading to user data corruption by copying data to incorrect locations. Furthermore, if the sum of iter->pos and iomap_length() is not page-aligned, the function fails to copy a full block, resulting in partial population of the destination block. This partial copy exposes stale persistent memory (pmem) contents, which is a serious confidentiality risk. The vulnerability also involves the lack of invalidation of inode pages after file metadata updates, meaning that programs with the file range mmap'd may continue accessing outdated memory mappings, potentially leading to further data integrity or confidentiality issues. The fix involves aligning copy positions and lengths to page boundaries to ensure full blocks are copied and addressing the missing invalidation step. This vulnerability affects Linux kernel versions identified by specific commit hashes and was published on November 9, 2024. There are no known exploits in the wild at this time, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses significant risks to data integrity and confidentiality, especially for systems using fsdax (filesystem direct access) with persistent memory. Organizations relying on Linux servers for critical data storage, databases, or applications that utilize persistent memory-backed filesystems may experience data corruption or leakage of stale sensitive data. This could lead to loss of trust, regulatory non-compliance (e.g., GDPR violations due to data exposure), and operational disruptions. The exposure of stale pmem contents could allow attackers or unauthorized users to access residual data that should have been overwritten, potentially leaking sensitive information. Additionally, corrupted data could cause application failures or data loss, impacting business continuity. Since the vulnerability affects kernel-level operations, exploitation could have widespread effects across multiple applications and services running on the affected Linux systems. The lack of known exploits currently reduces immediate risk but does not eliminate the potential for future attacks once the vulnerability becomes public knowledge.

European organizations should prioritize updating their Linux kernels to versions that include the patch for CVE-2024-50250 as soon as it becomes available. Until patches are applied, organizations should audit their use of fsdax and persistent memory filesystems to identify vulnerable systems. Limiting access to systems with persistent memory features and restricting mmap usage to trusted applications can reduce exposure. Implementing strict access controls and monitoring for unusual file system or memory access patterns may help detect exploitation attempts. Additionally, organizations should ensure that their backup and recovery procedures are robust to mitigate potential data corruption impacts. For environments where immediate patching is not feasible, consider disabling or avoiding the use of fsdax features that rely on dax_unshare_iter functionality. Collaboration with Linux distribution vendors to obtain timely security updates and testing patches in staging environments before deployment is recommended to avoid operational disruptions.