LiveActive security incident?Get immediate response
CVE Record

CVE-2024-56549: cachefiles: Fix NULL pointer dereference in object->file

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix NULL pointer dereference in object->file At present, the object->file has the NULL pointer dereference problem in ondemand-mode. The root cause is that the allocated fd and object->file lifetime are inconsistent, and the user-space invocation to anon_fd uses object->file. Following is the process that triggers the issue: [write fd] [umount] cachefiles_ondemand_fd_write_iter fscache_cookie_state_machine cachefiles_withdraw_cookie if (!file) return -ENOBUFS cachefiles_clean_up_object cachefiles_unmark_inode_in_use fput(object->file) object->file = NULL // file NULL pointer dereference! __cachefiles_write(..., file, ...) Fix this issue by add an additional reference count to the object->file before write/llseek, and decrement after it finished.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in the Linux CacheFiles on-demand caching mode can cause kernel code to use a file object after concurrent cleanup has cleared it. A locally authenticated, low-privileged user may trigger the condition without user interaction. The supplied CVSS score is 7.8, although the description establishes a NULL-pointer failure more clearly than broader compromise.

Executive priority

Prioritize systems that combine affected kernels, active CacheFiles on-demand use, and access by untrusted local users. Treat exposed multi-user or shared-compute hosts as urgent. Other systems should enter the normal high-severity kernel patch cycle after confirming applicability. There is no supplied evidence of active exploitation or a remote attack path.

Technical view

During an on-demand file-descriptor write or seek, concurrent unmount or cookie withdrawal can release object->file and set it to NULL before the operation uses it. This lifetime mismatch produces a NULL-pointer dereference. The Linux fix holds an additional reference to object->file across write and seek operations, then releases it afterward.

Likely exposure

Exposure is limited to Linux systems using CacheFiles on-demand mode on an affected kernel. The bundle identifies versions including 5.19, 6.1.129, 6.6.78, 6.11.11, 6.12.2, and 6.13, but distribution backports may alter status. Exact packaged-kernel mapping requires vendor confirmation.

Exploitation context

The CVSS vector indicates local access, low privileges, low complexity, and no user interaction. The supplied bundle does not identify public exploitation and marks the CVE as absent from KEV. It does not demonstrate remote exploitation or provide evidence that the rated confidentiality and integrity impacts have been achieved.

Researcher notes

The supplied description supports a concurrent object-lifetime defect involving cachefiles_ondemand_fd_write_iter and cleanup through cachefiles_withdraw_cookie. Stable commits implement reference acquisition around write and seek paths. Researchers should distinguish a reproducible NULL dereference from the broader CVSS confidentiality and integrity claims; the bundle supplies no exploitation evidence establishing those outcomes.

Mitigation direction

  • Upgrade to a vendor-supported kernel containing the applicable Linux stable fix.
  • Confirm the selected distribution kernel includes the fix, because version numbers may not reflect backports.
  • If patching is delayed, avoid CacheFiles on-demand mode where operationally feasible and vendor-supported.
  • Reduce unnecessary untrusted local account access until affected systems are remediated.

Validation and detection

  • Inventory kernel builds on systems using CacheFiles or FS-Cache functionality.
  • Determine whether CacheFiles on-demand mode is enabled or operationally used.
  • Compare each exact kernel build against distribution guidance and the referenced stable fixes.
  • Review kernel logs for CacheFiles-related NULL dereferences or crashes during unmount activity.
  • Retest affected caching and unmount workflows after upgrading.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-56549 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-56549Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc8383054506c77b814489c09877b5db83fd4abf2, c8383054506c77b814489c09877b5db83fd4abf2, c8383054506c77b814489c09877b5db83fd4abf2, c8383054506c77b814489c09877b5db83fd4abf2, c8383054506c77b814489c09877b5db83fd4abf2unaffected
LinuxLinux5.19, 0, 6.1.129, 6.6.78, 6.11.11, 6.12.2, 6.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.