CVE-2024-57952 is a vulnerability identified in the Linux kernel related to the handling of directory offsets during directory reads (readdir/getdents) on 32-bit systems. The issue stems from a reverted commit (64a7ce76fb90) that attempted to fix infinite directory reads by treating directory offsets as monotonically increasing integers rather than opaque cookies. The directory offset allocator uses a cyclic mechanism (mtree_alloc_cyclic) that assigns offset values which typically increase over time but eventually wrap around to lower values. On 64-bit platforms, the offset upper bound (2^63 - 1) is so large that wrapping is practically impossible within any realistic timeframe. However, on 32-bit platforms, the offset upper bound is 2^31 - 1, causing the offset allocator to wrap after a few weeks of uptime. The reverted commit introduced a comparison that stops listing directory entries once an entry's offset is larger than the current next_offset value. This results in directory entries with wrapped offsets becoming invisible in directory listings, although they remain accessible via direct lookup. Consequently, these entries effectively vanish from readdir output, causing persistent visibility issues. The vulnerability does not cause data loss or corruption but impacts the integrity of directory listings, potentially disrupting applications or services relying on complete directory enumeration. The Linux kernel maintainers reverted the problematic commit to prepare for a more robust fix that properly handles offset wrapping on 32-bit systems and recent long-term support (LTS) kernels using the simple_offset mechanism in shmem. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations, especially those operating legacy or embedded systems running 32-bit Linux kernels, this vulnerability can cause significant operational disruptions. Systems that rely on accurate directory listings for file management, backup solutions, monitoring tools, or security auditing may experience incomplete directory reads, leading to missed files or directories in automated processes. This can affect data integrity verification, compliance reporting, and incident response activities. While the vulnerability does not allow unauthorized access or direct data corruption, the invisibility of directory entries could mask the presence of files, complicating forensic investigations or malware detection. Organizations using 64-bit Linux systems are largely unaffected due to the impracticality of offset wrapping on those platforms. However, sectors such as industrial control systems, telecommunications, or IoT devices in Europe that still utilize 32-bit Linux kernels may be at higher risk. The impact is primarily on availability and integrity of directory enumeration rather than confidentiality.

European organizations should prioritize patching affected Linux kernels once the updated fix is released following the reversion of commit 64a7ce76fb90. In the interim, administrators of 32-bit Linux systems should monitor directory read operations for anomalies and consider implementing workarounds such as limiting system uptime to prevent offset wrapping or using alternative filesystem interfaces that do not rely on the affected offset mechanism. For critical systems, migrating to 64-bit Linux kernels where feasible will mitigate the risk entirely. Additionally, organizations should audit applications and scripts that depend on directory listings to ensure they can handle potential missing entries gracefully. Implementing enhanced logging and file integrity monitoring can help detect discrepancies caused by this vulnerability. Coordination with Linux distribution vendors for timely updates and testing patches in staging environments before deployment is recommended to avoid operational disruptions.