LiveActive security incident?Get immediate response
CVE Record

CVE-2024-57940: exfat: fix the infinite loop in exfat_readdir()

In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the cluster, 'dentry' will not be incremented, causing condition 'dentry < max_dentries' unable to prevent an infinite loop. This infinite loop causes s_lock not to be released, and other tasks will hang, such as exfat_sync_fs(). This commit stops traversing the cluster chain when there is unused directory entry in the cluster to avoid this infinite loop.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-57940 is a Linux kernel exFAT filesystem bug. A specially corrupted exFAT filesystem can make directory reading loop forever and hold a lock, causing related kernel tasks to hang. The main business risk is denial of service on systems that mount untrusted exFAT media or images.

Executive priority

Treat as a routine-to-priority stability fix where untrusted media is common. Prioritize endpoints, kiosks, appliances, and operational systems that may mount exFAT devices automatically. Lower priority for systems without exFAT use.

Technical view

In exfat_readdir(), a corrupted cluster chain where a cluster links to itself, combined with an unused directory entry, can prevent dentry from advancing. The max_dentries check then fails to stop traversal. The loop holds s_lock, blocking other tasks such as exfat_sync_fs(). Kernel stable commits stop traversing when an unused entry is encountered.

Likely exposure

Exposure is most likely on Linux systems with exFAT support that mount removable media, user-supplied storage, or disk images. Servers that never mount exFAT are less exposed. Embedded and industrial products using affected Linux kernels may depend on vendor updates.

Exploitation context

No CISA KEV listing or source-provided active exploitation evidence is included. Exploitation appears to require a corrupted exFAT filesystem being mounted or processed. The documented impact is hang/denial of service, not code execution or data theft.

Researcher notes

The CVE record provides no CVSS score or CWE. Affected data indicates Linux kernel versions from exFAT introduction with fixes in stable branches including 5.10.234, 5.15.177, 6.1.125, 6.6.72, 6.12.10, and 6.13. Validate through distro backport status rather than upstream version alone.

Mitigation direction

  • Update to a kernel containing the referenced exFAT stable fixes.
  • Apply Debian LTS or vendor kernel updates where applicable.
  • For appliances or industrial products, follow Siemens or device-vendor advisories.
  • Avoid mounting untrusted exFAT media or images until patched.
  • Disable or restrict exFAT automounting where operationally feasible.

Validation and detection

  • Inventory Linux systems and products with exFAT filesystem support enabled.
  • Compare running kernels against fixed stable versions or distro backports.
  • Review vendor advisories for embedded or packaged Linux products.
  • Check whether removable media or user-supplied disk images are mounted automatically.
  • Confirm patched kernels include the exfat_readdir() infinite-loop fix.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-57940 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
11Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxca06197382bde0a3bc20215595d1c9ce20c6e341, ca06197382bde0a3bc20215595d1c9ce20c6e341, ca06197382bde0a3bc20215595d1c9ce20c6e341, ca06197382bde0a3bc20215595d1c9ce20c6e341, ca06197382bde0a3bc20215595d1c9ce20c6e341, ca06197382bde0a3bc20215595d1c9ce20c6e341unaffected
LinuxLinux5.7, 0, 5.10.234, 5.15.177, 6.1.125, 6.6.72, 6.12.10, 6.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.