Security readout for executives and security teams
Plain-English summary
A race condition in the Linux CacheFiles subsystem can access memory after it has been freed. A local, low-privileged user may be able to trigger serious confidentiality, integrity, or availability effects. The issue was reproduced during fault-injection stress testing; the supplied sources do not establish real-world exploitation.
Executive priority
Treat this as a timely kernel-maintenance priority, especially on shared Linux systems using CacheFiles. It is high severity but not evidenced as remotely or actively exploited. Expedite normal vendor kernel updates and reboot verification; prioritize exposed multi-user environments over systems where the subsystem is absent or unused.
Technical view
During concurrent cache withdrawal and cookie lookup, a CacheFiles volume can be freed before cachefiles_withdraw_cookie() dereferences it. The correction changes withdrawal ordering so in-flight lookups and object accounting complete before volume memory is released. The reported KASAN finding occurred on a development Linux 6.8 kernel.
Likely exposure
Exposure requires an affected Linux kernel and use of the relevant CacheFiles/FS-Cache path. CVSS indicates local access, low complexity, low privileges, and no user interaction. Internet reachability alone does not create remote exposure. The bundled version list is ambiguous, so confirm distribution backports and package status through vendor guidance.
Exploitation context
CISA KEV status is false, and no supplied source reports active exploitation or a public weaponized exploit. Evidence is limited to a fault-injection stress-test reproduction. Exploitability and resulting impact may depend on kernel configuration, CacheFiles use, workload timing, and access by a local low-privileged user.
Researcher notes
The race occurs when cache withdrawal overlaps a lookup that allocates an object referencing a volume. Volume memory may then be freed before cookie withdrawal reads object->volume->cache. The fix calls fscache_withdraw_volume() before cachefiles_withdraw_objects(), closing the accounting window. The bundle supplies no CWE classification or confirmed exploitation evidence.
Mitigation direction
- Identify hosts running Linux kernels that use CacheFiles or FS-Cache.
- Apply a supported vendor kernel containing the linked stable correction, then reboot into it.
- If updating is delayed, consult distribution guidance for supported mitigations; none are specified in this bundle.
- Prioritize multi-user or untrusted-workload systems where local low-privileged access exists.
Validation and detection
- Record the running kernel version, not only the installed package version.
- Confirm whether CacheFiles or FS-Cache is configured, loaded, or actively used on each host.
- Map distribution kernel builds to vendor advisories or the linked stable commits.
- After remediation, verify the running kernel includes the correction and review logs for memory-safety symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-41057 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8de253177112a47c9af157d23ae934779188b4e1CVE reference, Linux
- https://git.kernel.org/stable/c/9e67589a4a7b7e5660b524d1d5fe61242bcbcc11CVE reference, Linux
- https://git.kernel.org/stable/c/ef81340401e8a371d6b17f69e76d861920972cfeCVE reference, Linux
- https://git.kernel.org/stable/c/5d8f805789072ea7fd39504694b7bd17e5f751c4CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.