🛡️ CVE-2024-49883 — debian-linux

🟠 CVSS 7.8 — High ✅ No Known Exploit CWE-416 NVD
7.8
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

ext4: aovid use-after-free in ext4_ext_insert_extent()

In the Linux kernel, the following vulnerability has been resolved:

ext4: aovid use-after-free in ext4_ext_insert_extent()

As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is

reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and

cause UAF. Below is a sample trace with dummy values:

ext4_ext_insert_extent

path = *ppath = 2000

ext4_ext_create_new_leaf(ppath)

ext4_find_extent(ppath)

path = *ppath = 2000

if (depth > path[0].p_maxdepth)

kfree(path = 2000);

*ppath = path = NULL;

path = kcalloc() = 3000

*ppath = 3000;

return path;

/* here path is still 2000, UAF! */

eh = path[depth].p_hdr

==================================================================

BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330

Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179

CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866

Call Trace:

<TASK>

ext4_ext_insert_extent+0x26d4/0x3330

ext4_ext_map_blocks+0xe22/0x2d40

ext4_map_blocks+0x71e/0x1700

ext4_do_writepages+0x1290/0x2800

[...]

Allocated by task 179:

ext4_find_extent+0x81c/0x1f70

ext4_ext_map_blocks+0x146/0x2d40

ext4_map_blocks+0x71e/0x1700

ext4_do_writepages+0x1290/0x2800

ext4_writepages+0x26d/0x4e0

do_writepages+0x175/0x700

[...]

Freed by task 179:

kfree+0xcb/0x240

ext4_find_extent+0x7c0/0x1f70

ext4_ext_insert_extent+0xa26/0x3330

ext4_ext_map_blocks+0xe22/0x2d40

ext4_map_blocks+0x71e/0x1700

ext4_do_writepages+0x1290/0x2800

ext4_writepages+0x26d/0x4e0

do_writepages+0x175/0x700

[...]

==================================================================

So use *ppath to update the path to avoid the above problem.

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability high.

Weakness class

CVE-2024-49883 is classified as CWE-416: Use After Free. Memory is used after being released, so its contents may already belong to something else.

Affected software

CVE-2024-49883 is recorded against 3 packages.

  • debian-linux
  • kernel (from 6.11.0 up to 6.11.3)
  • linux-kernel (from 6.11 up to 6.11.3)

Timeline and source

Published on 21 October 2024 and last revised on 4 August 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.

References

git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
lists.debian.org
lists.debian.org

CVE-2024-49883 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity HIGH
CVSS Score 7.8
CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE CWE-416
Public Exploit ✅ No
Source NVD
Published 2024-10-21
Updated 2026-08-12
Modified 2026-08-04

Affected Packages

Software From version Fixed in
debian-linux — —
kernel 6.11.0 6.11.3
linux-kernel 6.11 6.11.3

References

Similar Threats

Site Security Check

Is debian-linux part of your stack?

CVE-2024-49883 is rated CVSS 7.8 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.