Security readout for executives and security teams
Plain-English summary
A race condition in the Linux kernel’s CacheFiles on-demand feature can leave one process using a request after another process frees it. An authenticated local user may be able to trigger serious memory corruption, potentially affecting confidentiality, integrity, or availability. Systems not using the affected CacheFiles functionality are less likely to be exposed.
Executive priority
Treat this as a high-priority kernel update for multi-user or otherwise locally accessible systems using CacheFiles on-demand. Broader emergency action is not supported by the supplied evidence because exploitation is local, feature-dependent, and not documented as active. Require asset owners to verify both feature use and vendor patch status.
Technical view
During request flushing, completed CacheFiles on-demand requests remained reachable in the cache request xarray. A concurrent daemon read could select a request after the waiting path freed it, causing a use-after-free. The upstream fix removes requests from the xarray while flushing. CVSS 3.1 is 7.8: local, low complexity, low privileges, no user interaction, with potentially high impact.
Likely exposure
Exposure requires an affected Linux kernel, use of CacheFiles on-demand functionality, and local low-privileged access. The supplied version data identifies affected releases including 5.19, 6.1.95, 6.6.35, 6.9.6, and 6.10, but distributors may backport fixes without changing upstream version numbers.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation or public weaponization. Exploitation is locally initiated and depends on a specific concurrency condition involving CacheFiles request handling. Absence from KEV does not establish that exploitation is impossible or has never occurred.
Researcher notes
The defect is a concurrency-driven use-after-free: flushing completes requests but previously left them indexed until xarray destruction, allowing selection after deallocation. The fix changes lifecycle ordering by removing requests during flushing. The bundle does not establish a reliable exploitation primitive, affected distribution package matrix, observed attacks, or specific compromise indicators.
Mitigation direction
- Install a vendor-supported kernel containing the referenced CacheFiles fix, then reboot into it.
- Check distributor advisories because patched package versions may differ from upstream kernel versions.
- Prioritize systems using CacheFiles on-demand and permitting untrusted or low-privileged local users.
- If updates are delayed, obtain supported interim mitigation guidance from the operating-system vendor.
Validation and detection
- Inventory running kernel versions and identify systems using CacheFiles on-demand functionality.
- Confirm the installed kernel package includes the fix or an equivalent vendor backport.
- Reboot updated systems and verify the running kernel matches the patched package.
- Review kernel logs for unexplained CacheFiles faults, memory corruption, or crashes without treating them as proof of exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-40900 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9f13aacdd4ee9a7644b2a3c96d67113cd083c9c7CVE reference, Linux
- https://git.kernel.org/stable/c/50d0e55356ba5b84ffb51c42704126124257e598CVE reference, Linux
- https://git.kernel.org/stable/c/37e19cf86a520d65de1de9cb330415c332a40d19CVE reference, Linux
- https://git.kernel.org/stable/c/0fc75c5940fa634d84e64c93bfc388e1274ed013CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.