CVE-2024-49966 in Linux
Summary
by MITRE • 10/21/2024
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: cancel dqi_sync_work before freeing oinfo
ocfs2_global_read_info() will initialize and schedule dqi_sync_work at the end, if error occurs after successfully reading global quota, it will trigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled:
ODEBUG: free active (active state 0) object: 00000000d8b0ce28 object type: timer_list hint: qsync_work_fn+0x0/0x16c
This reports that there is an active delayed work when freeing oinfo in error handling, so cancel dqi_sync_work first. BTW, return status instead of -1 when .read_file_info fails.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/21/2026
The vulnerability identified as CVE-2024-49966 resides within the Linux kernel's ocfs2 filesystem implementation, specifically addressing a critical resource management issue that can lead to system instability and potential denial of service conditions. This flaw manifests in the ocfs2_global_read_info() function where improper handling of delayed work objects occurs during error conditions, creating a scenario where active kernel timer objects remain in memory while their containing structures are being freed. The issue is particularly significant because it operates within the quota management subsystem of the ocfs2 filesystem, which handles distributed file system quotas across multiple nodes in a cluster environment. When CONFIG_DEBUG_OBJECTS_* is enabled, the kernel's object debugging infrastructure detects this condition and generates the specific warning message indicating that an active timer_list object is being freed, which violates fundamental kernel memory management principles and can lead to memory corruption or system crashes.
The technical root cause of this vulnerability stems from the improper sequence of operations within the error handling path of the ocfs2 quota management code. During the execution of ocfs2_global_read_info(), the function initializes and schedules a delayed work item named dqi_sync_work to handle quota synchronization tasks. However, when an error condition occurs after successfully reading global quota information, the code fails to cancel this scheduled work before proceeding to free the containing oinfo structure. This creates a race condition where the kernel timer_list object remains in an active state while its parent structure is being deallocated, leading to potential memory corruption when the timer expires and attempts to access freed memory. The vulnerability specifically demonstrates poor resource lifecycle management practices that violate the fundamental principles of kernel object management and can result in undefined behavior when the system attempts to process the pending work item.
The operational impact of this vulnerability extends beyond simple system instability to potentially compromise the integrity of distributed file system operations within ocfs2 environments. When the system encounters this condition, it can trigger kernel oops messages, system panics, or more subtle memory corruption issues that may not manifest immediately but could lead to data loss or system crashes during subsequent quota operations. The vulnerability affects systems running Linux kernels with ocfs2 filesystem support, particularly those configured with debugging objects enabled, making it more likely to be detected in development and testing environments. Organizations using ocfs2 in production clusters face potential risks of service disruption during quota management operations, especially when multiple nodes are involved in distributed quota synchronization. The timing of the vulnerability is particularly concerning as it occurs during error recovery paths, making it difficult to predict and prevent in production environments where quota reading operations might fail due to various conditions such as I/O errors, corrupted quota files, or resource exhaustion scenarios.
The recommended mitigation strategy for CVE-2024-49966 involves implementing the fix that ensures proper cancellation of the dqi_sync_work delayed work before freeing the oinfo structure during error handling conditions. This approach directly addresses the core issue by following the established kernel pattern of canceling active work items before freeing their containing structures, preventing the scenario where active timer_list objects remain in memory while their parent objects are deallocated. Additionally, the fix includes returning proper status codes instead of hardcoded -1 values when the .read_file_info operation fails, which improves error handling consistency and provides better diagnostic information for system administrators. Organizations should prioritize applying kernel updates that contain this fix, particularly those running ocfs2 filesystems in production environments where the vulnerability could lead to service disruption. The mitigation aligns with common security practices outlined in the CWE-459 weakness category, which addresses incomplete cleanup issues in software systems, and follows the ATT&CK technique T1499.004 for resource exhaustion attacks by preventing improper resource deallocation that could lead to system instability. System administrators should also monitor for kernel oops messages or system crashes that might indicate this vulnerability's presence and consider implementing additional monitoring for quota-related operations in ocfs2 environments.