---
id: CVE-2024-56549
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cachefiles: Fix NULL pointer dereference in object->file

  At present, the object->file has the NULL pointer dereference problem in
  ondemand-mode
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cachefiles: Fix NULL pointer dereference in object->file

  At present, the object->file has the NULL pointer dereference problem in
  ondemand-mode. The root cause is that…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.19, < 6.11.11'
  - 'linux_kernel >= 6.12, < 6.12.2'
patched:
  - linux_kernel 6.12.2
published: '2024-12-27'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:01.500'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-56549'
references:
  - url: 'https://git.kernel.org/stable/c/31ad74b20227ce6b40910ff78b1c604e42975cf1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/785408bbafcfa24c9fc5b251f03fd0780ce182bd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9582c7664103c9043e80a78f5c382aa6bdd67418'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d6bba3ece960129a553d4b16f1b00c884dc0993a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f98770440c9bc468e2fd878212ec9526dbe08293'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56549.json
  - url: 'https://access.redhat.com/security/cve/CVE-2024-56549'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2334478'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2024-56549'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-56549'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2024122730-CVE-2024-56549-ebcd@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00231
epssPercentile: 0.13886
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:41:03.958345Z'
scores:
  nvd: 7.8
  vendor: 5.5
  cna: 7.8
ingestedAt: '2026-10-15T22:48:25.443Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Fix NULL pointer dereference in object->file

At present, the object->file has the NULL pointer dereference problem in
ondemand-mode. The root cause is that the allocated fd and object->file
lifetime are inconsistent, and the user-space invocation to anon_fd uses
object->file. Following is the process that triggers the issue:

	  [write fd]				[umount]
cachefiles_ondemand_fd_write_iter
				       fscache_cookie_state_machine
					 cachefiles_withdraw_cookie
  if (!file) return -ENOBUFS
					   cachefiles_clean_up_object
					     cachefiles_unmark_inode_in_use
					     fput(object->file)
					     object->file = NULL
  // file NULL pointer dereference!
  __cachefiles_write(..., file, ...)

Fix this issue by add an additional reference count to the object->file
before write/llseek, and decrement after it finished.

## Affected

- `linux_kernel >= 5.19, < 6.11.11`
- `linux_kernel >= 6.12, < 6.12.2`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.12.2`

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56549.json)