CVE-2024-42256: Linux Kernel Server Re-Pick Vulnerability

CVE-2024-42256 Overview

CVE-2024-42256 affects the Linux kernel's CIFS (Common Internet File System) client implementation. The flaw resides in how the kernel handles server selection during subrequest retries in the SMB2 write path. When a subrequest is marked for retry, the netfs layer calls cifs_prepare_write(), which repicks the server before renegotiating credits. The subsequent call to cifs_issue_write() invokes smb2_async_writev(), which repicks the server again. If a different server is selected on the second pick, the server->in_flight counter is incremented on one record but decremented on another, causing credit misaccounting in multichannel SMB sessions.

Critical Impact
Credit misaccounting in CIFS multichannel mode can trigger kernel warnings in smb2_add_credits and destabilize SMB client behavior under retry conditions.

Affected Products

Linux Kernel (CIFS client subsystem)
Systems mounting SMB shares with multichannel enabled
Distributions shipping affected upstream kernel versions prior to the fix commits

Discovery Timeline

2024-08-08 - CVE-2024-42256 published to NVD
2024-09-06 - Last updated in NVD database

Technical Details for CVE-2024-42256

Vulnerability Analysis

The defect lives in the Linux kernel CIFS client path that handles asynchronous SMB2 writes. The netfs subsystem drives retries for failed subrequests. Before reissuing a write, netfs calls cifs_prepare_write() to select a transport server and renegotiate credits. The function smb2_async_writev() then performs a second, redundant server pick. The two picks are not guaranteed to return the same server in multichannel configurations.

When the second pick returns a different server, accounting bookkeeping splits across two transport records. The increment of server->in_flight lands on one server while the matching decrement lands on another. The result is a WARNING triggered at fs/smb/client/smb2ops.c:97 inside smb2_add_credits, observed via smb2_writev_callback and cifs_demultiplex_thread. The condition reproduces against Azure SMB servers in multichannel mode under xfstests such as generic/249, generic/215, and generic/308.

Root Cause

The root cause is a duplicate server-selection step in the SMB2 async write path. Both cifs_prepare_write() and smb2_async_writev() independently pick a transport server. Because netfs always invokes cifs_prepare_write() first, the second pick inside smb2_async_writev() is redundant and unsafe. The fix removes the repick logic from smb2_async_writev(), ensuring the server reference remains consistent across credit accounting operations.

Attack Vector

The issue is triggered by normal SMB2 write retry behavior against multichannel-capable SMB servers. No specially crafted payload is required. Workloads performing concurrent writes against multichannel mounts can reach the inconsistent state, leading to kernel warnings and credit accounting drift. Public references describe the manifestation as a kernel warning rather than a demonstrated remote exploitation primitive. See the upstream patch commits b1d0a566769b and de40579b9038 for the corrective changes.

// No verified exploit code is available for this vulnerability.
// Trigger conditions are documented in the upstream commit messages
// and reproduce under xfstests generic/249, generic/215, and generic/308
// against Azure SMB servers configured for multichannel operation.

Detection Methods for CVE-2024-42256

Indicators of Compromise

Kernel ring buffer entries containing WARNING: CPU: ... at fs/smb/client/smb2ops.c:97 smb2_add_credits with the cifs module tag
Stack traces showing smb2_writev_callback followed by cifs_demultiplex_thread after SMB write retries
Sustained credit accounting drift on SMB multichannel mounts visible in /proc/fs/cifs/Stats or DebugData

Detection Strategies

Monitor dmesg and journalctl -k for smb2_add_credits warnings on hosts mounting CIFS shares
Audit running kernel versions across the fleet and compare against the upstream stable commits that include the fix
Correlate CIFS warning events with workload patterns that drive subrequest retries, such as backups and large file copies over multichannel

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and alert on the specific smb2_add_credits warning signature
Track SMB client crash and warning rates per host to detect regression after kernel updates
Validate multichannel session counts and per-server in-flight credits during routine SMB health checks

How to Mitigate CVE-2024-42256

Immediate Actions Required

Inventory Linux hosts that mount SMB or CIFS shares, with priority on systems using multichannel against Azure Files or Windows servers
Update affected kernels to a version that incorporates the upstream stable patches referenced below
Restart SMB-dependent workloads after kernel updates to clear any drifted credit state

Patch Information

The fix removes the redundant server repick inside smb2_async_writev() so that the server reference established by cifs_prepare_write() remains authoritative. Apply the upstream stable commits b1d0a566769b and de40579b9038, or install a distribution kernel package that backports them.

Workarounds

Disable SMB multichannel on affected mounts until the patched kernel is deployed by omitting multichannel mount options or setting max_channels=1
Reduce retry pressure by avoiding workloads that generate frequent SMB write failures against multichannel servers
Reboot or remount affected shares when the smb2_add_credits warning appears to reset accounting state

bash

# Example: mount a CIFS share with a single channel to avoid the repick path
mount -t cifs //fileserver/share /mnt/share \
  -o username=user,password=pass,vers=3.1.1,max_channels=1