CVE-2024-50106 (GCVE-0-2024-50106)
Vulnerability from cvelistv5
Published
2024-11-05 17:10
Modified
2026-08-05 11:41
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix race between laundromat and free_stateid There is a race between laundromat handling of revoked delegations and a client sending free_stateid operation. Laundromat thread finds that delegation has expired and needs to be revoked so it marks the delegation stid revoked and it puts it on a reaper list but then it unlock the state lock and the actual delegation revocation happens without the lock. Once the stid is marked revoked a racing free_stateid processing thread does the following (1) it calls list_del_init() which removes it from the reaper list and (2) frees the delegation stid structure. The laundromat thread ends up not calling the revoke_delegation() function for this particular delegation but that means it will no release the lock lease that exists on the file. Now, a new open for this file comes in and ends up finding that lease list isn't empty and calls nfsd_breaker_owns_lease() which ends up trying to derefence a freed delegation stateid. Leading to the followint use-after-free KASAN warning: kernel: ================================================================== kernel: BUG: KASAN: slab-use-after-free in nfsd_breaker_owns_lease+0x140/0x160 [nfsd] kernel: Read of size 8 at addr ffff0000e73cd0c8 by task nfsd/6205 kernel: kernel: CPU: 2 UID: 0 PID: 6205 Comm: nfsd Kdump: loaded Not tainted 6.11.0-rc7+ #9 kernel: Hardware name: Apple Inc. Apple Virtualization Generic Platform, BIOS 2069.0.0.0.0 08/03/2024 kernel: Call trace: kernel: dump_backtrace+0x98/0x120 kernel: show_stack+0x1c/0x30 kernel: dump_stack_lvl+0x80/0xe8 kernel: print_address_description.constprop.0+0x84/0x390 kernel: print_report+0xa4/0x268 kernel: kasan_report+0xb4/0xf8 kernel: __asan_report_load8_noabort+0x1c/0x28 kernel: nfsd_breaker_owns_lease+0x140/0x160 [nfsd] kernel: nfsd_file_do_acquire+0xb3c/0x11d0 [nfsd] kernel: nfsd_file_acquire_opened+0x84/0x110 [nfsd] kernel: nfs4_get_vfs_file+0x634/0x958 [nfsd] kernel: nfsd4_process_open2+0xa40/0x1a40 [nfsd] kernel: nfsd4_open+0xa08/0xe80 [nfsd] kernel: nfsd4_proc_compound+0xb8c/0x2130 [nfsd] kernel: nfsd_dispatch+0x22c/0x718 [nfsd] kernel: svc_process_common+0x8e8/0x1960 [sunrpc] kernel: svc_process+0x3d4/0x7e0 [sunrpc] kernel: svc_handle_xprt+0x828/0xe10 [sunrpc] kernel: svc_recv+0x2cc/0x6a8 [sunrpc] kernel: nfsd+0x270/0x400 [nfsd] kernel: kthread+0x288/0x310 kernel: ret_from_fork+0x10/0x20 This patch proposes a fixed that's based on adding 2 new additional stid's sc_status values that help coordinate between the laundromat and other operations (nfsd4_free_stateid() and nfsd4_delegreturn()). First to make sure, that once the stid is marked revoked, it is not removed by the nfsd4_free_stateid(), the laundromat take a reference on the stateid. Then, coordinating whether the stid has been put on the cl_revoked list or we are processing FREE_STATEID and need to make sure to remove it from the list, each check that state and act accordingly. If laundromat has added to the cl_revoke list before the arrival of FREE_STATEID, then nfsd4_free_stateid() knows to remove it from the list. If nfsd4_free_stateid() finds that operations arrived before laundromat has placed it on cl_revoke list, it marks the state freed and then laundromat will no longer add it to the list. Also, for nfsd4_delegreturn() when looking for the specified stid, we need to access stid that are marked removed or freeable, it means the laundromat has started processing it but hasn't finished and this delegreturn needs to return nfserr_deleg_revoked and not nfserr_bad_stateid. The latter will not trigger a FREE_STATEID and the lack of it will leave this stid on the cl_revoked list indefinitely.
References
Impacted products
Vendor Product Version
Linux Linux Version: 83e733161fde43e2f99cefa68e369944460fce39
Version: 83e733161fde43e2f99cefa68e369944460fce39
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50106",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T14:48:58.818962Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T14:58:34.296Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/state.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "967faa26f313a62e7bebc55d5b8122eaee43b929",
              "status": "affected",
              "version": "83e733161fde43e2f99cefa68e369944460fce39",
              "versionType": "git"
            },
            {
              "lessThan": "8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a",
              "status": "affected",
              "version": "83e733161fde43e2f99cefa68e369944460fce39",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/state.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix race between laundromat and free_stateid\n\nThere is a race between laundromat handling of revoked delegations\nand a client sending free_stateid operation. Laundromat thread\nfinds that delegation has expired and needs to be revoked so it\nmarks the delegation stid revoked and it puts it on a reaper list\nbut then it unlock the state lock and the actual delegation revocation\nhappens without the lock. Once the stid is marked revoked a racing\nfree_stateid processing thread does the following (1) it calls\nlist_del_init() which removes it from the reaper list and (2) frees\nthe delegation stid structure. The laundromat thread ends up not\ncalling the revoke_delegation() function for this particular delegation\nbut that means it will no release the lock lease that exists on\nthe file.\n\nNow, a new open for this file comes in and ends up finding that\nlease list isn\u0027t empty and calls nfsd_breaker_owns_lease() which ends\nup trying to derefence a freed delegation stateid. Leading to the\nfollowint use-after-free KASAN warning:\n\nkernel: ==================================================================\nkernel: BUG: KASAN: slab-use-after-free in nfsd_breaker_owns_lease+0x140/0x160 [nfsd]\nkernel: Read of size 8 at addr ffff0000e73cd0c8 by task nfsd/6205\nkernel:\nkernel: CPU: 2 UID: 0 PID: 6205 Comm: nfsd Kdump: loaded Not tainted 6.11.0-rc7+ #9\nkernel: Hardware name: Apple Inc. Apple Virtualization Generic Platform, BIOS 2069.0.0.0.0 08/03/2024\nkernel: Call trace:\nkernel: dump_backtrace+0x98/0x120\nkernel: show_stack+0x1c/0x30\nkernel: dump_stack_lvl+0x80/0xe8\nkernel: print_address_description.constprop.0+0x84/0x390\nkernel: print_report+0xa4/0x268\nkernel: kasan_report+0xb4/0xf8\nkernel: __asan_report_load8_noabort+0x1c/0x28\nkernel: nfsd_breaker_owns_lease+0x140/0x160 [nfsd]\nkernel: nfsd_file_do_acquire+0xb3c/0x11d0 [nfsd]\nkernel: nfsd_file_acquire_opened+0x84/0x110 [nfsd]\nkernel: nfs4_get_vfs_file+0x634/0x958 [nfsd]\nkernel: nfsd4_process_open2+0xa40/0x1a40 [nfsd]\nkernel: nfsd4_open+0xa08/0xe80 [nfsd]\nkernel: nfsd4_proc_compound+0xb8c/0x2130 [nfsd]\nkernel: nfsd_dispatch+0x22c/0x718 [nfsd]\nkernel: svc_process_common+0x8e8/0x1960 [sunrpc]\nkernel: svc_process+0x3d4/0x7e0 [sunrpc]\nkernel: svc_handle_xprt+0x828/0xe10 [sunrpc]\nkernel: svc_recv+0x2cc/0x6a8 [sunrpc]\nkernel: nfsd+0x270/0x400 [nfsd]\nkernel: kthread+0x288/0x310\nkernel: ret_from_fork+0x10/0x20\n\nThis patch proposes a fixed that\u0027s based on adding 2 new additional\nstid\u0027s sc_status values that help coordinate between the laundromat\nand other operations (nfsd4_free_stateid() and nfsd4_delegreturn()).\n\nFirst to make sure, that once the stid is marked revoked, it is not\nremoved by the nfsd4_free_stateid(), the laundromat take a reference\non the stateid. Then, coordinating whether the stid has been put\non the cl_revoked list or we are processing FREE_STATEID and need to\nmake sure to remove it from the list, each check that state and act\naccordingly. If laundromat has added to the cl_revoke list before\nthe arrival of FREE_STATEID, then nfsd4_free_stateid() knows to remove\nit from the list. If nfsd4_free_stateid() finds that operations arrived\nbefore laundromat has placed it on cl_revoke list, it marks the state\nfreed and then laundromat will no longer add it to the list.\n\nAlso, for nfsd4_delegreturn() when looking for the specified stid,\nwe need to access stid that are marked removed or freeable, it means\nthe laundromat has started processing it but hasn\u0027t finished and this\ndelegreturn needs to return nfserr_deleg_revoked and not\nnfserr_bad_stateid. The latter will not trigger a FREE_STATEID and the\nlack of it will leave this stid on the cl_revoked list indefinitely."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerability is in the in-kernel NFS server (nfsd) and is driven entirely by NFSv4.1 protocol operations (OPEN, FREE_STATEID, DELEGRETURN) arriving over TCP/2049 from a remote client, as shown by the `svc_recv`/`svc_process`/`nfsd4_proc_compound` call chain in the report. No local access to the server is needed.\nAC:L - The attacker controls both sides: it creates the delegation, forces the recall with its own conflicting OPEN, learns the exact revocation deadline from the server-supplied FATTR4_LEASE_TIME attribute, and then issues FREE_STATEID at will; queuing many delegations stretches the laundromat\u0027s per-item `kernel_setlease(F_UNLCK)` window to milliseconds and the whole sequence can be retried indefinitely.\nPR:N - Reaching `nfsd4_free_stateid()` requires only an NFSv4.1 session established via EXCHANGE_ID/CREATE_SESSION plus an OPEN, and under the default AUTH_SYS security flavor no credentials are ever verified \u2014 the client merely asserts an identity, with only host-based export matching as a gate, matching the treatment of client-triggerable nfsd state-handling flaws.\nUI:N - The attacker performs every step itself \u2014 obtaining the delegation, triggering the recall from a second client identity, letting the lease expire, racing FREE_STATEID, and then re-opening the file to trip the dangling lease. No action by any local user or administrator is required.\nS:U - The freed `nfs4_delegation`, the `file_lease` on the inode, and the corrupted slab memory all belong to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a slab use-after-free: `nfsd_breaker_owns_lease()` and `nfsd_break_deleg_cb()` read `dl_stid.sc_client`, `sc_file` and `dl_recall` out of the freed `nfs4_delegation`, and since `deleg_slab` is created with flags 0 (mergeable) and can be refilled at will by acquiring new delegations, the attacker controls the reclaimed contents and can turn the dereferences into an arbitrary kernel-memory read.\nI:H - The dangling lease gives direct write primitives \u2014 `dp-\u003edl_recalled = true` into freed memory, `atomic_inc(\u0026clp-\u003ecl_delegs_in_recall)` and `fp-\u003efi_had_conflict = true` through pointers sourced from the freed object, `refcount_inc()` on freed state \u2014 and `nfsd4_run_cb(\u0026dp-\u003edl_recall)` performs an indirect call through a `cb-\u003ecb_ops` table read from reclaimed memory, a direct path to heap corruption and control-flow hijack.\nA:H - The changelog documents a KASAN slab-use-after-free oops in `nfsd_breaker_owns_lease()` inside an nfsd kthread, and the leaked lease plus the `DELEGRETURN` returning `nfserr_bad_stateid` strands stateids on `cl_revoked` and pins `nfsd_file`/inode references indefinitely; the crash kills the NFS service and can be reproduced at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:42.406Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/967faa26f313a62e7bebc55d5b8122eaee43b929"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a"
        }
      ],
      "title": "nfsd: fix race between laundromat and free_stateid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50106",
    "datePublished": "2024-11-05T17:10:40.747Z",
    "dateReserved": "2024-10-21T19:36:19.946Z",
    "dateUpdated": "2026-08-05T11:41:42.406Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50106\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-11T14:48:58.818962Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-11T14:49:00.556Z\"}}], \"cna\": {\"title\": \"nfsd: fix race between laundromat and free_stateid\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"83e733161fde43e2f99cefa68e369944460fce39\", \"lessThan\": \"967faa26f313a62e7bebc55d5b8122eaee43b929\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"83e733161fde43e2f99cefa68e369944460fce39\", \"lessThan\": \"8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfsd/nfs4state.c\", \"fs/nfsd/state.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfsd/nfs4state.c\", \"fs/nfsd/state.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/967faa26f313a62e7bebc55d5b8122eaee43b929\"}, {\"url\": \"https://git.kernel.org/stable/c/8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix race between laundromat and free_stateid\\n\\nThere is a race between laundromat handling of revoked delegations\\nand a client sending free_stateid operation. Laundromat thread\\nfinds that delegation has expired and needs to be revoked so it\\nmarks the delegation stid revoked and it puts it on a reaper list\\nbut then it unlock the state lock and the actual delegation revocation\\nhappens without the lock. Once the stid is marked revoked a racing\\nfree_stateid processing thread does the following (1) it calls\\nlist_del_init() which removes it from the reaper list and (2) frees\\nthe delegation stid structure. The laundromat thread ends up not\\ncalling the revoke_delegation() function for this particular delegation\\nbut that means it will no release the lock lease that exists on\\nthe file.\\n\\nNow, a new open for this file comes in and ends up finding that\\nlease list isn\u0027t empty and calls nfsd_breaker_owns_lease() which ends\\nup trying to derefence a freed delegation stateid. Leading to the\\nfollowint use-after-free KASAN warning:\\n\\nkernel: ==================================================================\\nkernel: BUG: KASAN: slab-use-after-free in nfsd_breaker_owns_lease+0x140/0x160 [nfsd]\\nkernel: Read of size 8 at addr ffff0000e73cd0c8 by task nfsd/6205\\nkernel:\\nkernel: CPU: 2 UID: 0 PID: 6205 Comm: nfsd Kdump: loaded Not tainted 6.11.0-rc7+ #9\\nkernel: Hardware name: Apple Inc. Apple Virtualization Generic Platform, BIOS 2069.0.0.0.0 08/03/2024\\nkernel: Call trace:\\nkernel: dump_backtrace+0x98/0x120\\nkernel: show_stack+0x1c/0x30\\nkernel: dump_stack_lvl+0x80/0xe8\\nkernel: print_address_description.constprop.0+0x84/0x390\\nkernel: print_report+0xa4/0x268\\nkernel: kasan_report+0xb4/0xf8\\nkernel: __asan_report_load8_noabort+0x1c/0x28\\nkernel: nfsd_breaker_owns_lease+0x140/0x160 [nfsd]\\nkernel: nfsd_file_do_acquire+0xb3c/0x11d0 [nfsd]\\nkernel: nfsd_file_acquire_opened+0x84/0x110 [nfsd]\\nkernel: nfs4_get_vfs_file+0x634/0x958 [nfsd]\\nkernel: nfsd4_process_open2+0xa40/0x1a40 [nfsd]\\nkernel: nfsd4_open+0xa08/0xe80 [nfsd]\\nkernel: nfsd4_proc_compound+0xb8c/0x2130 [nfsd]\\nkernel: nfsd_dispatch+0x22c/0x718 [nfsd]\\nkernel: svc_process_common+0x8e8/0x1960 [sunrpc]\\nkernel: svc_process+0x3d4/0x7e0 [sunrpc]\\nkernel: svc_handle_xprt+0x828/0xe10 [sunrpc]\\nkernel: svc_recv+0x2cc/0x6a8 [sunrpc]\\nkernel: nfsd+0x270/0x400 [nfsd]\\nkernel: kthread+0x288/0x310\\nkernel: ret_from_fork+0x10/0x20\\n\\nThis patch proposes a fixed that\u0027s based on adding 2 new additional\\nstid\u0027s sc_status values that help coordinate between the laundromat\\nand other operations (nfsd4_free_stateid() and nfsd4_delegreturn()).\\n\\nFirst to make sure, that once the stid is marked revoked, it is not\\nremoved by the nfsd4_free_stateid(), the laundromat take a reference\\non the stateid. Then, coordinating whether the stid has been put\\non the cl_revoked list or we are processing FREE_STATEID and need to\\nmake sure to remove it from the list, each check that state and act\\naccordingly. If laundromat has added to the cl_revoke list before\\nthe arrival of FREE_STATEID, then nfsd4_free_stateid() knows to remove\\nit from the list. If nfsd4_free_stateid() finds that operations arrived\\nbefore laundromat has placed it on cl_revoke list, it marks the state\\nfreed and then laundromat will no longer add it to the list.\\n\\nAlso, for nfsd4_delegreturn() when looking for the specified stid,\\nwe need to access stid that are marked removed or freeable, it means\\nthe laundromat has started processing it but hasn\u0027t finished and this\\ndelegreturn needs to return nfserr_deleg_revoked and not\\nnfserr_bad_stateid. The latter will not trigger a FREE_STATEID and the\\nlack of it will leave this stid on the cl_revoked list indefinitely.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:46:08.479Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50106\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:46:08.479Z\", \"dateReserved\": \"2024-10-21T19:36:19.946Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-05T17:10:40.747Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.