Executive brief
A vulnerability in the Linux kernel's file notification system can cause system instability or a temporary freeze. When a directory contains a very large number of files, removing a file watch can trigger a resource conflict that locks up the processor. This could allow a local user to cause a denial-of-service condition, impacting the availability of the system.
Technical details
A race condition exists in the fsnotify subsystem of the Linux kernel due to improper synchronization in __fsnotify_update_child_dentry_flags(). When a directory has many dentries, the function takes a significant amount of time to execute under the inode->i_lock. This creates contention between fsnotify_recalc_mask() and __fsnotify_parent() calls on child dentries. An attacker with local access can exploit this to trigger softlockups, leading to a denial of service. The fix implements lazy clearing of PARENT_WATCHED flags to reduce lock contention.
Affected products
- Linux Linux Kernel up to 5.10.226, 5.11 to 5.15.167, 5.16 to 6.1.109, 6.2 to 6.6.50, 6.7 to 6.10.9
Timeline
- 2024-10-09: disclosed
- 2024-10-09: advisory
References
- https://git.kernel.org/stable/c/172e422ffea20a89bfdc672741c1aad6fbb5044e
- https://git.kernel.org/stable/c/3f3ef1d9f66b93913ce2171120d9226b55acd41d
- https://git.kernel.org/stable/c/7ef1d2e240c32b1f337a37232d037b07e3919e1a
- https://git.kernel.org/stable/c/d8c42405fc3507cc43ba7e4986a773c3fc633f6e
- https://git.kernel.org/stable/c/f9a48bc3dd9099935751458a5bbbea4b7c28abc8
- https://git.kernel.org/stable/c/fc1b1e135c3f72382f792e6c319fc088d5523ad5
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html