CVE-2024-40900

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to a use-after-free vulnerability in the cachefiles component of the Linux kernel. This vulnerability can be exploited to potentially elevate privileges. The vulnerability occurs when requests are not properly removed from the cache during flushing, allowing for the possibility of accessing freed requests. The cachefiles flush reqs function is involved in this issue, and the req->msg.opcode is checked against CACHEFILES OP READ. The vulnerability can be exploited due to a concurrency issue between daemon thread1 and daemon thread2, where a request may be used after it has been freed.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.