GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49983 (GCVE-0-2024-49983)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:02 – Updated: 2026-08-05 11:40
VLAI
Title
ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free When calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(), the 'ppath' is updated but it is the 'path' that is freed, thus potentially triggering a double-free in the following process: ext4_ext_replay_update_ex ppath = path ext4_force_split_extent_at(&ppath) ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth ext4_find_extent if (depth > path[0].p_maxdepth) kfree(path) ---> path First freed *orig_path = path = NULL ---> null ppath kfree(path) ---> path double-free !!! So drop the unnecessary ppath and use path directly to avoid this problem. And use ext4_find_extent() directly to update path, avoiding unnecessary memory allocation and freeing. Also, propagate the error returned by ext4_find_extent() instead of using strange error codes.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:32 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 , < 8c26d9e53e5fbacda0732a577e97c5a5b7882aaf (git)
Affected: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 , < a34bed978364114390162c27e50fca50791c568d (git)
Affected: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 , < 6367d3f04c69e2b8770b8137bd800e0784b0abbc (git)
Affected: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 , < 1b558006d98b7b0b730027be0ee98973dd10ee0d (git)
Affected: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 , < 3ff710662e8d86a63a39b334e9ca0cb10e5c14b0 (git)
Affected: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 , < 63adc9016917e6970fb0104ee5fd6770f02b2d80 (git)
Affected: 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2 , < 5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.55 , ≤ 6.6.* (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49983",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:32:15.569255Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:44.023Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:24:05.400Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c26d9e53e5fbacda0732a577e97c5a5b7882aaf",
              "status": "affected",
              "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
              "versionType": "git"
            },
            {
              "lessThan": "a34bed978364114390162c27e50fca50791c568d",
              "status": "affected",
              "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
              "versionType": "git"
            },
            {
              "lessThan": "6367d3f04c69e2b8770b8137bd800e0784b0abbc",
              "status": "affected",
              "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
              "versionType": "git"
            },
            {
              "lessThan": "1b558006d98b7b0b730027be0ee98973dd10ee0d",
              "status": "affected",
              "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
              "versionType": "git"
            },
            {
              "lessThan": "3ff710662e8d86a63a39b334e9ca0cb10e5c14b0",
              "status": "affected",
              "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
              "versionType": "git"
            },
            {
              "lessThan": "63adc9016917e6970fb0104ee5fd6770f02b2d80",
              "status": "affected",
              "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
              "versionType": "git"
            },
            {
              "lessThan": "5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95",
              "status": "affected",
              "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free\n\nWhen calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(),\nthe \u0027ppath\u0027 is updated but it is the \u0027path\u0027 that is freed, thus potentially\ntriggering a double-free in the following process:\n\next4_ext_replay_update_ex\n  ppath = path\n  ext4_force_split_extent_at(\u0026ppath)\n    ext4_split_extent_at\n      ext4_ext_insert_extent\n        ext4_ext_create_new_leaf\n          ext4_ext_grow_indepth\n            ext4_find_extent\n              if (depth \u003e path[0].p_maxdepth)\n                kfree(path)                 ---\u003e path First freed\n                *orig_path = path = NULL    ---\u003e null ppath\n  kfree(path)                               ---\u003e path double-free !!!\n\nSo drop the unnecessary ppath and use path directly to avoid this problem.\nAnd use ext4_find_extent() directly to update path, avoiding unnecessary\nmemory allocation and freeing. Also, propagate the error returned by\next4_find_extent() instead of using strange error codes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only entry point is `mount(2)` on a locally-attached block device holding an ext4 image whose journal carries an unreplayed fast-commit area; `ext4_ext_replay_update_ex()` has no callers outside `ext4_fc_replay_add_range()`, so there is no network- or adjacent-reachable path.\nAC:L - The attacker authors the entire image, so the extent-tree depth, the ADD_RANGE records and the corrupted extent block that makes the inner `ext4_find_extent()` fail are all chosen deterministically \u2014 no race and no memory-layout dependency outside attacker control, and standard slab grooming decides what reclaims the freed `kmalloc-N` object.\nPR:L - ext4 lacks `FS_USERNS_MOUNT` so `mount(2)` itself wants CAP_SYS_ADMIN, but an ordinary local user reaches the identical replay path by attaching removable media that udisks2/autofs mounts automatically, or via a `user` fstab entry \u2014 the standard crafted-ext4-image threat model on kiosks, workstations and embedded devices.\nUI:N - The attacker performs the mount themselves, either directly or by inserting media whose automount is unattended, so no action by a separate victim user is needed.\nS:U - The freed object, the stale dereferences and the corrupted slab freelist all live in the kernel\u0027s own memory and security authority; no hypervisor, IOMMU or sandbox boundary is crossed.\nC:H - `ext4_free_ext_path()` on the dangling pointer reads `p_depth` and every `p_bh` field back out of the already-freed, potentially reclaimed slab object, so attacker-groomed content is dereferenced as `struct buffer_head *` \u2014 a use-after-free read that yields arbitrary kernel-memory disclosure and kernel address leaks.\nI:H - The double `kfree()` corrupts the SLUB freelist, allowing the same chunk to be handed out twice and later overwritten, and the intervening `brelse()`/`put_bh()` decrements a refcount at an attacker-influenced address \u2014 together a controlled write primitive leveragable for control-flow hijack and privilege escalation.\nA:H - Even unexploited, a double-free plus dereference of freed `struct ext4_ext_path` entries reliably trips slab corruption detection or oopses in `brelse()` during mount, panicking the machine, and the mount can be repeated at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:52.589Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c26d9e53e5fbacda0732a577e97c5a5b7882aaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/a34bed978364114390162c27e50fca50791c568d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6367d3f04c69e2b8770b8137bd800e0784b0abbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b558006d98b7b0b730027be0ee98973dd10ee0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ff710662e8d86a63a39b334e9ca0cb10e5c14b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/63adc9016917e6970fb0104ee5fd6770f02b2d80"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95"
        }
      ],
      "title": "ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49983",
    "datePublished": "2024-10-21T18:02:28.474Z",
    "dateReserved": "2024-10-21T12:17:06.053Z",
    "dateUpdated": "2026-08-05T11:40:52.589Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49983",
      "date": "2026-09-19",
      "epss": "0.0025",
      "percentile": "0.16641"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "658E9248-9CAC-4A1E-A483-039DF6CCAF8C",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4D51C05D-455B-4D8D-89E7-A58E140B864C",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D01BD22E-ACD1-4618-9D01-6116570BE1EE",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E90B9576-56C4-47BC-AAB0-C5B2D438F5D0",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4C16BCE0-FFA0-4599-BE0A-1FD65101C021",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "54D9C704-D679-41A7-9C40-10A6B1E7FFE9",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free\n\nWhen calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(),\nthe \u0027ppath\u0027 is updated but it is the \u0027path\u0027 that is freed, thus potentially\ntriggering a double-free in the following process:\n\next4_ext_replay_update_ex\n  ppath = path\n  ext4_force_split_extent_at(\u0026ppath)\n    ext4_split_extent_at\n      ext4_ext_insert_extent\n        ext4_ext_create_new_leaf\n          ext4_ext_grow_indepth\n            ext4_find_extent\n              if (depth \u003e path[0].p_maxdepth)\n                kfree(path)                 ---\u003e path First freed\n                *orig_path = path = NULL    ---\u003e null ppath\n  kfree(path)                               ---\u003e path double-free !!!\n\nSo drop the unnecessary ppath and use path directly to avoid this problem.\nAnd use ext4_find_extent() directly to update path, avoiding unnecessary\nmemory allocation and freeing. Also, propagate the error returned by\next4_find_extent() instead of using strange error codes."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: eliminar ppath de ext4_ext_replay_update_ex() para evitar una doble liberaci\u00f3n Al llamar a ext4_force_split_extent_at() en ext4_ext_replay_update_ex(), se actualiza \u0027ppath\u0027 pero es \u0027path\u0027 el que se libera, lo que potencialmente desencadena una doble liberaci\u00f3n en el siguiente proceso: ext4_ext_replay_update_ex ppath = path ext4_force_split_extent_at(\u0026amp;ppath) ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth ext4_find_extent if (depth \u0026gt; path[0].p_maxdepth) kfree(path) ---\u0026gt; path Primero liberado *orig_path = path = NULL ---\u0026gt; null ppath kfree(path) ---\u0026gt; path double-free !!! Por lo tanto, elimine el ppath innecesario y use path directamente para evitar este problema. Y use ext4_find_extent() directamente para actualizar path, evitando la asignaci\u00f3n y liberaci\u00f3n de memoria innecesaria. Adem\u00e1s, propague el error devuelto por ext4_find_extent() en lugar de usar c\u00f3digos de error extra\u00f1os."
        }
      ],
      "id": "CVE-2024-49983",
      "lastModified": "2024-10-29T16:23:31.943",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-21T18:15:18.797",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/1b558006d98b7b0b730027be0ee98973dd10ee0d"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/3ff710662e8d86a63a39b334e9ca0cb10e5c14b0"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6367d3f04c69e2b8770b8137bd800e0784b0abbc"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/63adc9016917e6970fb0104ee5fd6770f02b2d80"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8c26d9e53e5fbacda0732a577e97c5a5b7882aaf"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/a34bed978364114390162c27e50fca50791c568d"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-415"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T03:01:48.000Z",
      "cve": "CVE-2024-49983",
      "id": "msrc_CVE-2024-49983",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-49983.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ext4/extents.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8c26d9e53e5fbacda0732a577e97c5a5b7882aaf",
                    "status": "affected",
                    "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a34bed978364114390162c27e50fca50791c568d",
                    "status": "affected",
                    "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6367d3f04c69e2b8770b8137bd800e0784b0abbc",
                    "status": "affected",
                    "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b558006d98b7b0b730027be0ee98973dd10ee0d",
                    "status": "affected",
                    "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3ff710662e8d86a63a39b334e9ca0cb10e5c14b0",
                    "status": "affected",
                    "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63adc9016917e6970fb0104ee5fd6770f02b2d80",
                    "status": "affected",
                    "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95",
                    "status": "affected",
                    "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ext4/extents.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.10"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.227",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.168",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.55",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "658E9248-9CAC-4A1E-A483-039DF6CCAF8C",
                    "versionEndExcluding": "5.10.227",
                    "versionStartIncluding": "5.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4D51C05D-455B-4D8D-89E7-A58E140B864C",
                    "versionEndExcluding": "5.15.168",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D01BD22E-ACD1-4618-9D01-6116570BE1EE",
                    "versionEndExcluding": "6.1.113",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E90B9576-56C4-47BC-AAB0-C5B2D438F5D0",
                    "versionEndExcluding": "6.6.55",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4C16BCE0-FFA0-4599-BE0A-1FD65101C021",
                    "versionEndExcluding": "6.10.14",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "54D9C704-D679-41A7-9C40-10A6B1E7FFE9",
                    "versionEndExcluding": "6.11.3",
                    "versionStartIncluding": "6.11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free\n\nWhen calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(),\nthe \u0027ppath\u0027 is updated but it is the \u0027path\u0027 that is freed, thus potentially\ntriggering a double-free in the following process:\n\next4_ext_replay_update_ex\n  ppath = path\n  ext4_force_split_extent_at(\u0026ppath)\n    ext4_split_extent_at\n      ext4_ext_insert_extent\n        ext4_ext_create_new_leaf\n          ext4_ext_grow_indepth\n            ext4_find_extent\n              if (depth \u003e path[0].p_maxdepth)\n                kfree(path)                 ---\u003e path First freed\n                *orig_path = path = NULL    ---\u003e null ppath\n  kfree(path)                               ---\u003e path double-free !!!\n\nSo drop the unnecessary ppath and use path directly to avoid this problem.\nAnd use ext4_find_extent() directly to update path, avoiding unnecessary\nmemory allocation and freeing. Also, propagate the error returned by\next4_find_extent() instead of using strange error codes."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: eliminar ppath de ext4_ext_replay_update_ex() para evitar una doble liberaci\u00f3n Al llamar a ext4_force_split_extent_at() en ext4_ext_replay_update_ex(), se actualiza \u0027ppath\u0027 pero es \u0027path\u0027 el que se libera, lo que potencialmente desencadena una doble liberaci\u00f3n en el siguiente proceso: ext4_ext_replay_update_ex ppath = path ext4_force_split_extent_at(\u0026amp;ppath) ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth ext4_find_extent if (depth \u0026gt; path[0].p_maxdepth) kfree(path) ---\u0026gt; path Primero liberado *orig_path = path = NULL ---\u0026gt; null ppath kfree(path) ---\u0026gt; path double-free !!! Por lo tanto, elimine el ppath innecesario y use path directamente para evitar este problema. Y use ext4_find_extent() directamente para actualizar path, evitando la asignaci\u00f3n y liberaci\u00f3n de memoria innecesaria. Adem\u00e1s, propague el error devuelto por ext4_find_extent() en lugar de usar c\u00f3digos de error extra\u00f1os."
          }
        ],
        "id": "CVE-2024-49983",
        "lastModified": "2026-08-04T11:21:05.523",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-49983",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:32:15.569255Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-21T18:15:18.797",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1b558006d98b7b0b730027be0ee98973dd10ee0d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3ff710662e8d86a63a39b334e9ca0cb10e5c14b0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6367d3f04c69e2b8770b8137bd800e0784b0abbc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/63adc9016917e6970fb0104ee5fd6770f02b2d80"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8c26d9e53e5fbacda0732a577e97c5a5b7882aaf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a34bed978364114390162c27e50fca50791c568d"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:47:34+00:00",
      "cve": "CVE-2024-49983",
      "id": "CVE-2024-49983",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49983.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:57:28Z",
      "cve": "CVE-2024-49983",
      "id": "CVE-2024-49983",
      "initial_release_date": "2024-10-24T03:18:11Z",
      "product_status:known_affected": "432",
      "product_status:known_not_affected": "328",
      "product_status:recommended": "676",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49983",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49983.json",
      "version": "66"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T22:24:05.400Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-49983",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-22T13:32:15.569255Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-22T13:32:18.790Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/ext4/extents.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "8c26d9e53e5fbacda0732a577e97c5a5b7882aaf",
                  "status": "affected",
                  "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                  "versionType": "git"
                },
                {
                  "lessThan": "a34bed978364114390162c27e50fca50791c568d",
                  "status": "affected",
                  "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                  "versionType": "git"
                },
                {
                  "lessThan": "6367d3f04c69e2b8770b8137bd800e0784b0abbc",
                  "status": "affected",
                  "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                  "versionType": "git"
                },
                {
                  "lessThan": "1b558006d98b7b0b730027be0ee98973dd10ee0d",
                  "status": "affected",
                  "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                  "versionType": "git"
                },
                {
                  "lessThan": "3ff710662e8d86a63a39b334e9ca0cb10e5c14b0",
                  "status": "affected",
                  "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                  "versionType": "git"
                },
                {
                  "lessThan": "63adc9016917e6970fb0104ee5fd6770f02b2d80",
                  "status": "affected",
                  "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                  "versionType": "git"
                },
                {
                  "lessThan": "5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95",
                  "status": "affected",
                  "version": "8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/ext4/extents.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.10"
                },
                {
                  "lessThan": "5.10",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.227",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.168",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.113",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.55",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.14",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.227",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.168",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.113",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.55",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.14",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.3",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free\n\nWhen calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(),\nthe \u0027ppath\u0027 is updated but it is the \u0027path\u0027 that is freed, thus potentially\ntriggering a double-free in the following process:\n\next4_ext_replay_update_ex\n  ppath = path\n  ext4_force_split_extent_at(\u0026ppath)\n    ext4_split_extent_at\n      ext4_ext_insert_extent\n        ext4_ext_create_new_leaf\n          ext4_ext_grow_indepth\n            ext4_find_extent\n              if (depth \u003e path[0].p_maxdepth)\n                kfree(path)                 ---\u003e path First freed\n                *orig_path = path = NULL    ---\u003e null ppath\n  kfree(path)                               ---\u003e path double-free !!!\n\nSo drop the unnecessary ppath and use path directly to avoid this problem.\nAnd use ext4_find_extent() directly to update path, avoiding unnecessary\nmemory allocation and freeing. Also, propagate the error returned by\next4_find_extent() instead of using strange error codes."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The only entry point is `mount(2)` on a locally-attached block device holding an ext4 image whose journal carries an unreplayed fast-commit area; `ext4_ext_replay_update_ex()` has no callers outside `ext4_fc_replay_add_range()`, so there is no network- or adjacent-reachable path.\nAC:L - The attacker authors the entire image, so the extent-tree depth, the ADD_RANGE records and the corrupted extent block that makes the inner `ext4_find_extent()` fail are all chosen deterministically \u2014 no race and no memory-layout dependency outside attacker control, and standard slab grooming decides what reclaims the freed `kmalloc-N` object.\nPR:L - ext4 lacks `FS_USERNS_MOUNT` so `mount(2)` itself wants CAP_SYS_ADMIN, but an ordinary local user reaches the identical replay path by attaching removable media that udisks2/autofs mounts automatically, or via a `user` fstab entry \u2014 the standard crafted-ext4-image threat model on kiosks, workstations and embedded devices.\nUI:N - The attacker performs the mount themselves, either directly or by inserting media whose automount is unattended, so no action by a separate victim user is needed.\nS:U - The freed object, the stale dereferences and the corrupted slab freelist all live in the kernel\u0027s own memory and security authority; no hypervisor, IOMMU or sandbox boundary is crossed.\nC:H - `ext4_free_ext_path()` on the dangling pointer reads `p_depth` and every `p_bh` field back out of the already-freed, potentially reclaimed slab object, so attacker-groomed content is dereferenced as `struct buffer_head *` \u2014 a use-after-free read that yields arbitrary kernel-memory disclosure and kernel address leaks.\nI:H - The double `kfree()` corrupts the SLUB freelist, allowing the same chunk to be handed out twice and later overwritten, and the intervening `brelse()`/`put_bh()` decrements a refcount at an attacker-influenced address \u2014 together a controlled write primitive leveragable for control-flow hijack and privilege escalation.\nA:H - Even unexploited, a double-free plus dereference of freed `struct ext4_ext_path` entries reliably trips slab corruption detection or oopses in `brelse()` during mount, panicking the machine, and the mount can be repeated at will."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:40:52.589Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/8c26d9e53e5fbacda0732a577e97c5a5b7882aaf"
            },
            {
              "url": "https://git.kernel.org/stable/c/a34bed978364114390162c27e50fca50791c568d"
            },
            {
              "url": "https://git.kernel.org/stable/c/6367d3f04c69e2b8770b8137bd800e0784b0abbc"
            },
            {
              "url": "https://git.kernel.org/stable/c/1b558006d98b7b0b730027be0ee98973dd10ee0d"
            },
            {
              "url": "https://git.kernel.org/stable/c/3ff710662e8d86a63a39b334e9ca0cb10e5c14b0"
            },
            {
              "url": "https://git.kernel.org/stable/c/63adc9016917e6970fb0104ee5fd6770f02b2d80"
            },
            {
              "url": "https://git.kernel.org/stable/c/5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95"
            }
          ],
          "title": "ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-49983",
        "datePublished": "2024-10-21T18:02:28.474Z",
        "dateReserved": "2024-10-21T12:17:06.053Z",
        "dateUpdated": "2026-08-05T11:40:52.589Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.