In the Linux kernel, the following vulnerability has been resolved:
Revert "libfs: fix infinite directory reads for offset dir"
The current directory offset allocator (based on mtreealloccyclic) stores the next offset value to return in octx->next_offset. This mechanism typically returns values that increase monotonically over time. Eventually, though, the newly allocated offset value wraps back to a low number (say, 2) which is smaller than other already- allocated offset values.
Yu Kuai yukuai3@huawei.com reports that, after commit 64a7ce76fb90 ("libfs: fix infinite directory reads for offset dir"), if a directory's offset allocator wraps, existing entries are no longer visible via readdir/getdents because offsetreaddir() stops listing entries once an entry's offset is larger than octx->nextoffset. These entries vanish persistently -- they can be looked up, but will never again appear in readdir(3) output.
The reason for this is that the commit treats directory offsets as monotonically increasing integer values rather than opaque cookies, and introduces this comparison:
if (dentry2offset(dentry) >= last_index) {
On 64-bit platforms, the directory offset value upper bound is 2^63 - 1. Directory offsets will monotonically increase for millions of years without wrapping.
On 32-bit platforms, however, LONG_MAX is 2^31 - 1. The allocator can wrap after only a few weeks (at worst).
Revert commit 64a7ce76fb90 ("libfs: fix infinite directory reads for offset dir") to prepare for a fix that can work properly on 32-bit systems and might apply to recent LTS kernels where shmem employs the simple_offset mechanism.
[
    {
        "id": "CVE-2024-57952-07a9ff81",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_readdir"
        },
        "digest": {
            "function_hash": "118787933761910690352791785156367159203",
            "length": 295.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b662d858131da9a8a14e68661656989b14dbf113"
    },
    {
        "id": "CVE-2024-57952-2707b333",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_dir_open"
        },
        "digest": {
            "function_hash": "72598842873171186693692418063745282927",
            "length": 185.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e9e710f68bac49bd9b587823c077d06363440e0"
    },
    {
        "id": "CVE-2024-57952-2b844610",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "fs/libfs.c"
        },
        "digest": {
            "line_hashes": [
                "190789291916773494599218581884906668298",
                "90508579968147477134957865784520050859",
                "280421835295113980998267960562202779382",
                "245400267829633820292120039443203985922",
                "29651164600914004294714137788931983747",
                "269834113169757806700895708111718366310",
                "295512106337731320202870362479533864377",
                "135379526877587033775712796843850288135",
                "311507146058700170151616144015138410822",
                "115085185307411823193576440396591437629",
                "53283267504379227628124445651242611108",
                "164564635915604548894320869091709721317",
                "33355430546147031838359149269082660700",
                "332862213482050325214306595338949599207",
                "142284311782077980536884281067051640703",
                "117212986074806541819760840955717096233",
                "162697095042487648660211919877905650814",
                "94901443638161257831636998138383571965",
                "260756112316089489373902357945188900829",
                "329822432441418130645079386002506213037",
                "222160835519622119974944392009838192220",
                "131100163732711020636329137105036514552",
                "51315854616636273158437987469672593354",
                "132389541046218058987130363845916479770",
                "244583868061184985905723704129762250582",
                "180599653690975052712912651930472186718",
                "29940135212807690807750962693782099804",
                "244056818656165074361404805815451895577",
                "284626116159071421571447112632479603740",
                "128779042017068597979376035051618745863",
                "320174533621980634781799098477406806579",
                "54151719819151699461682821844446617562",
                "134501460118871340057183905779216913014",
                "229184097166437868495796380419691634125",
                "113492958312786500516266651940855397425",
                "137886253352468411064477498942571059392",
                "185852813044554091642475555980972372431",
                "201945432513668751077727522650045707761",
                "75492429256816174122137023824366568575",
                "312685818438742339300741833146770698927",
                "235777068411769374833574767373971003677",
                "109296953433997348424775042708636536924",
                "66137666498919766030041807110403525055",
                "212493862634289321486865082213735909892",
                "305942537659364060485884399699285181233",
                "264519214050822083521533829142300477631",
                "83803369058180578625303136009201284147",
                "83728915920980479325650507051892841458",
                "114268650219971718906280669494660475185"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e9e710f68bac49bd9b587823c077d06363440e0"
    },
    {
        "id": "CVE-2024-57952-3902831c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "fs/libfs.c"
        },
        "digest": {
            "line_hashes": [
                "190789291916773494599218581884906668298",
                "90508579968147477134957865784520050859",
                "280421835295113980998267960562202779382",
                "245400267829633820292120039443203985922",
                "29651164600914004294714137788931983747",
                "269834113169757806700895708111718366310",
                "295512106337731320202870362479533864377",
                "135379526877587033775712796843850288135",
                "311507146058700170151616144015138410822",
                "115085185307411823193576440396591437629",
                "53283267504379227628124445651242611108",
                "164564635915604548894320869091709721317",
                "33355430546147031838359149269082660700",
                "332862213482050325214306595338949599207",
                "142284311782077980536884281067051640703",
                "117212986074806541819760840955717096233",
                "162697095042487648660211919877905650814",
                "94901443638161257831636998138383571965",
                "260756112316089489373902357945188900829",
                "329822432441418130645079386002506213037",
                "222160835519622119974944392009838192220",
                "131100163732711020636329137105036514552",
                "51315854616636273158437987469672593354",
                "132389541046218058987130363845916479770",
                "244583868061184985905723704129762250582",
                "180599653690975052712912651930472186718",
                "29940135212807690807750962693782099804",
                "244056818656165074361404805815451895577",
                "284626116159071421571447112632479603740",
                "128779042017068597979376035051618745863",
                "320174533621980634781799098477406806579",
                "54151719819151699461682821844446617562",
                "134501460118871340057183905779216913014",
                "229184097166437868495796380419691634125",
                "113492958312786500516266651940855397425",
                "137886253352468411064477498942571059392",
                "185852813044554091642475555980972372431",
                "201945432513668751077727522650045707761",
                "75492429256816174122137023824366568575",
                "312685818438742339300741833146770698927",
                "235777068411769374833574767373971003677",
                "109296953433997348424775042708636536924",
                "66137666498919766030041807110403525055",
                "212493862634289321486865082213735909892",
                "305942537659364060485884399699285181233",
                "264519214050822083521533829142300477631",
                "83803369058180578625303136009201284147",
                "83728915920980479325650507051892841458",
                "114268650219971718906280669494660475185"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f250b82040a72b0059ae00855a74d8570ad2147"
    },
    {
        "id": "CVE-2024-57952-46712885",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "fs/libfs.c"
        },
        "digest": {
            "line_hashes": [
                "190789291916773494599218581884906668298",
                "90508579968147477134957865784520050859",
                "280421835295113980998267960562202779382",
                "245400267829633820292120039443203985922",
                "29651164600914004294714137788931983747",
                "269834113169757806700895708111718366310",
                "295512106337731320202870362479533864377",
                "135379526877587033775712796843850288135",
                "311507146058700170151616144015138410822",
                "115085185307411823193576440396591437629",
                "53283267504379227628124445651242611108",
                "164564635915604548894320869091709721317",
                "33355430546147031838359149269082660700",
                "332862213482050325214306595338949599207",
                "142284311782077980536884281067051640703",
                "117212986074806541819760840955717096233",
                "162697095042487648660211919877905650814",
                "94901443638161257831636998138383571965",
                "260756112316089489373902357945188900829",
                "329822432441418130645079386002506213037",
                "222160835519622119974944392009838192220",
                "131100163732711020636329137105036514552",
                "51315854616636273158437987469672593354",
                "132389541046218058987130363845916479770",
                "244583868061184985905723704129762250582",
                "180599653690975052712912651930472186718",
                "29940135212807690807750962693782099804",
                "244056818656165074361404805815451895577",
                "284626116159071421571447112632479603740",
                "128779042017068597979376035051618745863",
                "320174533621980634781799098477406806579",
                "54151719819151699461682821844446617562",
                "134501460118871340057183905779216913014",
                "229184097166437868495796380419691634125",
                "113492958312786500516266651940855397425",
                "137886253352468411064477498942571059392",
                "185852813044554091642475555980972372431",
                "201945432513668751077727522650045707761",
                "75492429256816174122137023824366568575",
                "312685818438742339300741833146770698927",
                "235777068411769374833574767373971003677",
                "109296953433997348424775042708636536924",
                "66137666498919766030041807110403525055",
                "212493862634289321486865082213735909892",
                "305942537659364060485884399699285181233",
                "264519214050822083521533829142300477631",
                "83803369058180578625303136009201284147",
                "83728915920980479325650507051892841458",
                "114268650219971718906280669494660475185"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b662d858131da9a8a14e68661656989b14dbf113"
    },
    {
        "id": "CVE-2024-57952-5d85dcf8",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_readdir"
        },
        "digest": {
            "function_hash": "118787933761910690352791785156367159203",
            "length": 295.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e9e710f68bac49bd9b587823c077d06363440e0"
    },
    {
        "id": "CVE-2024-57952-7efb159b",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_dir_llseek"
        },
        "digest": {
            "function_hash": "99647563218916549202484327591225602904",
            "length": 438.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f250b82040a72b0059ae00855a74d8570ad2147"
    },
    {
        "id": "CVE-2024-57952-81e7fcdf",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_dir_llseek"
        },
        "digest": {
            "function_hash": "99647563218916549202484327591225602904",
            "length": 438.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e9e710f68bac49bd9b587823c077d06363440e0"
    },
    {
        "id": "CVE-2024-57952-8699291f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_dir_open"
        },
        "digest": {
            "function_hash": "72598842873171186693692418063745282927",
            "length": 185.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b662d858131da9a8a14e68661656989b14dbf113"
    },
    {
        "id": "CVE-2024-57952-9ee357f1",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_readdir"
        },
        "digest": {
            "function_hash": "118787933761910690352791785156367159203",
            "length": 295.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f250b82040a72b0059ae00855a74d8570ad2147"
    },
    {
        "id": "CVE-2024-57952-b06605b1",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_iterate_dir"
        },
        "digest": {
            "function_hash": "136239453598001480929603630931744980041",
            "length": 414.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f250b82040a72b0059ae00855a74d8570ad2147"
    },
    {
        "id": "CVE-2024-57952-c3e1eab3",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_iterate_dir"
        },
        "digest": {
            "function_hash": "136239453598001480929603630931744980041",
            "length": 414.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b662d858131da9a8a14e68661656989b14dbf113"
    },
    {
        "id": "CVE-2024-57952-c66c650c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_dir_llseek"
        },
        "digest": {
            "function_hash": "99647563218916549202484327591225602904",
            "length": 438.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b662d858131da9a8a14e68661656989b14dbf113"
    },
    {
        "id": "CVE-2024-57952-ca461048",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_dir_open"
        },
        "digest": {
            "function_hash": "72598842873171186693692418063745282927",
            "length": 185.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f250b82040a72b0059ae00855a74d8570ad2147"
    },
    {
        "id": "CVE-2024-57952-f40b0ae8",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "fs/libfs.c",
            "function": "offset_iterate_dir"
        },
        "digest": {
            "function_hash": "136239453598001480929603630931744980041",
            "length": 414.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e9e710f68bac49bd9b587823c077d06363440e0"
    }
]