Executive brief
A vulnerability in the Linux kernel's execution handling could allow a local user to trigger system warnings and potential instability. This occurs due to a technical race condition when checking file permissions during the execution of a program. While it does not directly allow data theft, it can impact system reliability and operational monitoring.
Technical details
A race condition existed in the Linux kernel's exec component within the path_noexec() check. Previously, the kernel used WARN_ON_ONCE to validate that a file being executed was a regular file and not on a noexec-mounted filesystem, but these checks were redundant with earlier validation steps. Because the path_noexec check was performed without sufficient synchronization against concurrent flag changes, it could trigger spurious kernel warnings (kernel oops/warnings) if another process modified the mount flags simultaneously. The fix removes the WARN_ON wrapper while maintaining the functional check to prevent unnecessary system alerts and potential automated reboot-on-warn scenarios.
Affected products
- Linux Linux kernel up to 6.11.3
Timeline
- 2024-10-21: disclosed
- 2024-10-21: advisory
References
- https://git.kernel.org/stable/c/0bdf77be2330062b3a64f2bec39f62ab874a6796
- https://git.kernel.org/stable/c/0d16f53c91111cec914f0811fcc526a2ba77b20d
- https://git.kernel.org/stable/c/0d196e7589cefe207d5d41f37a0a28a1fdeeb7c6
- https://git.kernel.org/stable/c/b723f96407a0a078cf75970e4dbf16b46d286a61
- https://git.kernel.org/stable/c/c9b77438077d5a20c79ead95bcdaf9bd4797baaf
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html