VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 12, 2024· Updated Nov 3, 2025

cachefiles: flush all requests after setting CACHEFILES_DEAD

CVE-2024-40935

Description

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: flush all requests after setting CACHEFILES_DEAD

In ondemand mode, when the daemon is processing an open request, if the kernel flags the cache as CACHEFILES_DEAD, the cachefiles_daemon_write() will always return -EIO, so the daemon can't pass the copen to the kernel. Then the kernel process that is waiting for the copen triggers a hung_task.

Since the DEAD state is irreversible, it can only be exited by closing /dev/cachefiles. Therefore, after calling cachefiles_io_error() to mark the cache as CACHEFILES_DEAD, if in ondemand mode, flush all requests to avoid the above hungtask. We may still be able to read some of the cached data before closing the fd of /dev/cachefiles.

Note that this relies on the patch that adds reference counting to the req, otherwise it may UAF.

Affected products

96

Patches

4
85e833cd7243
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
e73fac950848
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
3bf0b8030296
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
320ba9cbca78
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.