LiveActive security incident?Get immediate response
CVE Record

CVE-2024-36001: netfs: Fix the pre-flush when appending to a file in writethrough mode

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix the pre-flush when appending to a file in writethrough mode In netfs_perform_write(), when the file is marked NETFS_ICTX_WRITETHROUGH or O_*SYNC or RWF_*SYNC was specified, write-through caching is performed on a buffered file. When setting up for write-through, we flush any conflicting writes in the region and wait for the write to complete, failing if there's a write error to return. The issue arises if we're writing at or above the EOF position because we skip the flush and - more importantly - the wait. This becomes a problem if there's a partial folio at the end of the file that is being written out and we want to make a write to it too. Both the already-running write and the write we start both want to clear the writeback mark, but whoever is second causes a warning looking something like: ------------[ cut here ]------------ R=00000012: folio 11 is not under writeback WARNING: CPU: 34 PID: 654 at fs/netfs/write_collect.c:105 ... CPU: 34 PID: 654 Comm: kworker/u386:27 Tainted: G S ... ... Workqueue: events_unbound netfs_write_collection_worker ... RIP: 0010:netfs_writeback_lookup_folio Fix this by making the flush-and-wait unconditional. It will do nothing if there are no folios in the pagecache and will return quickly if there are no folios in the region specified. Further, move the WBC attachment above the flush call as the flush is going to attach a WBC and detach it again if it is not present - and since we need one anyway we might as well share it.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux netfs write-ordering flaw can mishandle overlapping writeback when data is appended in write-through or synchronous mode. The supplied description documents a kernel warning caused by competing writes. Although scored 7.8, the sources do not demonstrate practical confidentiality, integrity, or availability impact.

Executive priority

Treat as a high-priority kernel maintenance issue on systems matching the affected versions and workload. Accelerate remediation for netfs-heavy or multi-user hosts, but avoid claiming compromise: the supplied evidence establishes faulty writeback coordination and a warning, not observed exploitation or demonstrated data loss.

Technical view

netfs_perform_write() skipped its pre-flush and wait at or beyond EOF. A concurrent writeback of the final partial folio could then overlap a new append, causing both operations to clear the same writeback marker. The fix makes flush-and-wait unconditional and attaches the writeback-control structure earlier.

Likely exposure

The bundle identifies Linux kernel 6.8 through 6.8.9 and 6.9 as affected. Exposure is most plausible where netfs-backed files receive append or at-EOF writes using write-through, O_*SYNC, or RWF_*SYNC behavior. Distribution backports may change actual status.

Exploitation context

The supplied CVSS vector describes local access, low complexity, low privileges, and no user interaction. CVE-2024-36001 is not listed as KEV in the bundle, and no supplied source reports active exploitation or a public exploit. Practical security consequences remain insufficiently evidenced here.

Researcher notes

The central condition is an at-or-beyond-EOF write overlapping writeback of a partial final folio. Assess reachability through the deployed netfs consumer and sync flags. The two stable commits are the authoritative supplied fix references. No CWE is provided, and the bundle does not reconcile the CVSS impact claims with demonstrated outcomes.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable stable fix or backport.
  • Check distribution advisories for package-specific affected and fixed versions.
  • Prioritize systems using netfs-backed storage with synchronous or write-through append workloads.
  • Follow current Linux or distribution vendor guidance if immediate updating is unavailable.

Validation and detection

  • Inventory running kernel versions and distribution package revisions.
  • Confirm the vendor marks each deployed kernel build fixed or unaffected.
  • Verify the applicable stable fix is present in custom kernel source trees.
  • Review kernel logs for the documented netfs writeback warning signature.
  • Safely regression-test synchronous append workloads after updating.
Prepared
Confidence
medium
Sources
4

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-36001 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-36001Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux41d8e7673a7726cba57cb8112d81c89cfb6c3e35, 41d8e7673a7726cba57cb8112d81c89cfb6c3e35unaffected
LinuxLinux6.8, 0, 6.8.9, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.