GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50088 (GCVE-0-2024-50088)

Vulnerability from cvelistv5 – Published: 2024-10-29 00:50 – Updated: 2026-08-05 11:41
VLAI
Title
btrfs: fix uninitialized pointer free in add_inode_ref()
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix uninitialized pointer free in add_inode_ref() The add_inode_ref() function does not initialize the "name" struct when it is declared. If any of the following calls to "read_one_inode() returns NULL, dir = read_one_inode(root, parent_objectid); if (!dir) { ret = -ENOENT; goto out; } inode = read_one_inode(root, inode_objectid); if (!inode) { ret = -EIO; goto out; } then "name.name" would be freed on "out" before being initialized. out: ... kfree(name.name); This issue was reported by Coverity with CID 1526744.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:23 UTC
CWE
  • CWE-824 - Access of Uninitialized Pointer
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1cf474cd474bc5d3ef63086ffd009a87a5b7bb2e , < 12cf028381aa19bc38465341512c280256e8d82d (git)
Affected: e43eec81c5167b655b72c781b0e75e62a05e415e , < e11ce03b58743bf1e096c48fcaa7e6f08eb75dfa (git)
Affected: e43eec81c5167b655b72c781b0e75e62a05e415e , < a941f3d5b1469c60a7e70e775584f110b47e0d16 (git)
Affected: e43eec81c5167b655b72c781b0e75e62a05e415e , < 66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4 (git)
Affected: 6.1.57 , < 6.1.114 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.1.114 , ≤ 6.1.* (semver)
Unaffected: 6.6.58 , ≤ 6.6.* (semver)
Unaffected: 6.11.5 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50088",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:23:09.128991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-824",
                "description": "CWE-824 Access of Uninitialized Pointer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:20.079Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:25:21.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/tree-log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "12cf028381aa19bc38465341512c280256e8d82d",
              "status": "affected",
              "version": "1cf474cd474bc5d3ef63086ffd009a87a5b7bb2e",
              "versionType": "git"
            },
            {
              "lessThan": "e11ce03b58743bf1e096c48fcaa7e6f08eb75dfa",
              "status": "affected",
              "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
              "versionType": "git"
            },
            {
              "lessThan": "a941f3d5b1469c60a7e70e775584f110b47e0d16",
              "status": "affected",
              "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
              "versionType": "git"
            },
            {
              "lessThan": "66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4",
              "status": "affected",
              "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.114",
              "status": "affected",
              "version": "6.1.57",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/tree-log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.114",
                  "versionStartIncluding": "6.1.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.58",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.5",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix uninitialized pointer free in add_inode_ref()\n\nThe add_inode_ref() function does not initialize the \"name\" struct when\nit is declared.  If any of the following calls to \"read_one_inode()\nreturns NULL,\n\n\tdir = read_one_inode(root, parent_objectid);\n\tif (!dir) {\n\t\tret = -ENOENT;\n\t\tgoto out;\n\t}\n\n\tinode = read_one_inode(root, inode_objectid);\n\tif (!inode) {\n\t\tret = -EIO;\n\t\tgoto out;\n\t}\n\nthen \"name.name\" would be freed on \"out\" before being initialized.\n\nout:\n\t...\n\tkfree(name.name);\n\nThis issue was reported by Coverity with CID 1526744."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through btrfs log-tree replay during `open_ctree()`/`btrfs_replay_log()`, i.e. by mounting an attacker-crafted filesystem image, which requires local access to the system. The image can be supplied as an ordinary file and loop-mounted, so no physical device access is needed.\nAC:L - The attacker fully authors the on-disk log tree \u2014 inode ref/extref keys, parent objectids, and name lengths \u2014 so both the NULL `read_one_inode()` return and the stack-slot priming are deterministic; `replay_one_buffer()` deliberately continues past `-ENOENT`, letting the attacker stage a preceding call that leaves a known dangling pointer in the identical stack slot. No unpredictable condition must be won.\nPR:L - Mounting btrfs nominally needs CAP_SYS_ADMIN, but udisks2/`LoopSetup` and desktop/kiosk automount let a basic unprivileged local user get an arbitrary attacker-supplied btrfs image mounted, so real root in the initial namespace is not required.\nUI:N - In the realistic kiosk/workstation deployment, automount (or the attacker\u0027s own udisks2 loop-mount of a file they control) mounts the crafted image without any other user participating, and replay then runs unconditionally \u2014 including for read-only mounts.\nS:U - The corruption is confined to the kernel\u0027s own slab allocator and control flow within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `kfree()` of an uninitialized/stale pointer yields a controlled double free of an attacker-size-selected kmalloc object, which reallocates into a live kernel object and gives a use-after-free read primitive over arbitrary kernel memory.\nI:H - The same double free/UAF over a general-purpose kmalloc slab permits heap grooming, type confusion, and arbitrary kernel write, which is exploitable for control-flow hijack and privilege escalation.\nA:H - In the common case the uninitialized stack value is not a valid slab pointer, so `kfree()` faults in `virt_to_head_page()`/`__free_frozen_pages()` and oopses during mount; the double-free variant trips SLUB corruption BUGs. Either way the kernel panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:33.818Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/12cf028381aa19bc38465341512c280256e8d82d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e11ce03b58743bf1e096c48fcaa7e6f08eb75dfa"
        },
        {
          "url": "https://git.kernel.org/stable/c/a941f3d5b1469c60a7e70e775584f110b47e0d16"
        },
        {
          "url": "https://git.kernel.org/stable/c/66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4"
        }
      ],
      "title": "btrfs: fix uninitialized pointer free in add_inode_ref()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50088",
    "datePublished": "2024-10-29T00:50:31.362Z",
    "dateReserved": "2024-10-21T19:36:19.942Z",
    "dateUpdated": "2026-08-05T11:41:33.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50088",
      "date": "2026-09-16",
      "epss": "0.00214",
      "percentile": "0.1196"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.1.57\", \"versionEndExcluding\": \"6.1.114\", \"matchCriteriaId\": \"311F2B7D-7AE0-4373-81B3-7806F9A6E2DE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.58\", \"matchCriteriaId\": \"6B9489BC-825E-4EEE-8D93-F93C801988C8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.11.5\", \"matchCriteriaId\": \"6E62D61A-F704-44DB-A311-17B7534DA7BC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix uninitialized pointer free in add_inode_ref()\\n\\nThe add_inode_ref() function does not initialize the \\\"name\\\" struct when\\nit is declared.  If any of the following calls to \\\"read_one_inode()\\nreturns NULL,\\n\\n\\tdir = read_one_inode(root, parent_objectid);\\n\\tif (!dir) {\\n\\t\\tret = -ENOENT;\\n\\t\\tgoto out;\\n\\t}\\n\\n\\tinode = read_one_inode(root, inode_objectid);\\n\\tif (!inode) {\\n\\t\\tret = -EIO;\\n\\t\\tgoto out;\\n\\t}\\n\\nthen \\\"name.name\\\" would be freed on \\\"out\\\" before being initialized.\\n\\nout:\\n\\t...\\n\\tkfree(name.name);\\n\\nThis issue was reported by Coverity with CID 1526744.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: se corrige la liberaci\\u00f3n de un puntero no inicializado en add_inode_ref() La funci\\u00f3n add_inode_ref() no inicializa la estructura \\\"name\\\" cuando se declara. Si alguna de las siguientes llamadas a \\\"read_one_inode() devuelve NULL, dir = read_one_inode(root, parent_objectid); if (!dir) { ret = -ENOENT; goto out; } inode = read_one_inode(root, inode_objectid); if (!inode) { ret = -EIO; goto out; } entonces \\\"name.name\\\" se liberar\\u00eda en \\\"out\\\" antes de inicializarse. out: ... kfree(name.name); Este problema fue informado por Coverity con CID 1526744.\"}]",
      "id": "CVE-2024-50088",
      "lastModified": "2024-11-01T16:05:44.403",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-10-29T01:15:05.640",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/12cf028381aa19bc38465341512c280256e8d82d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a941f3d5b1469c60a7e70e775584f110b47e0d16\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e11ce03b58743bf1e096c48fcaa7e6f08eb75dfa\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-824\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T02:06:06.000Z",
      "cve": "CVE-2024-50088",
      "id": "msrc_CVE-2024-50088",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: fix uninitialized pointer free in add_inode_ref()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50088.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50088\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-29T01:15:05.640\",\"lastModified\":\"2026-06-17T08:03:33.250\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix uninitialized pointer free in add_inode_ref()\\n\\nThe add_inode_ref() function does not initialize the \\\"name\\\" struct when\\nit is declared.  If any of the following calls to \\\"read_one_inode()\\nreturns NULL,\\n\\n\\tdir = read_one_inode(root, parent_objectid);\\n\\tif (!dir) {\\n\\t\\tret = -ENOENT;\\n\\t\\tgoto out;\\n\\t}\\n\\n\\tinode = read_one_inode(root, inode_objectid);\\n\\tif (!inode) {\\n\\t\\tret = -EIO;\\n\\t\\tgoto out;\\n\\t}\\n\\nthen \\\"name.name\\\" would be freed on \\\"out\\\" before being initialized.\\n\\nout:\\n\\t...\\n\\tkfree(name.name);\\n\\nThis issue was reported by Coverity with CID 1526744.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: se corrige la liberaci\u00f3n de un puntero no inicializado en add_inode_ref() La funci\u00f3n add_inode_ref() no inicializa la estructura \\\"name\\\" cuando se declara. Si alguna de las siguientes llamadas a \\\"read_one_inode() devuelve NULL, dir = read_one_inode(root, parent_objectid); if (!dir) { ret = -ENOENT; goto out; } inode = read_one_inode(root, inode_objectid); if (!inode) { ret = -EIO; goto out; } entonces \\\"name.name\\\" se liberar\u00eda en \\\"out\\\" antes de inicializarse. out: ... kfree(name.name); Este problema fue informado por Coverity con CID 1526744.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/tree-log.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1cf474cd474bc5d3ef63086ffd009a87a5b7bb2e\",\"lessThan\":\"12cf028381aa19bc38465341512c280256e8d82d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e43eec81c5167b655b72c781b0e75e62a05e415e\",\"lessThan\":\"e11ce03b58743bf1e096c48fcaa7e6f08eb75dfa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e43eec81c5167b655b72c781b0e75e62a05e415e\",\"lessThan\":\"a941f3d5b1469c60a7e70e775584f110b47e0d16\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e43eec81c5167b655b72c781b0e75e62a05e415e\",\"lessThan\":\"66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.57\",\"lessThan\":\"6.1.114\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/tree-log.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.114\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.58\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.5\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:23:09.128991Z\",\"id\":\"CVE-2024-50088\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-824\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-824\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.57\",\"versionEndExcluding\":\"6.1.114\",\"matchCriteriaId\":\"311F2B7D-7AE0-4373-81B3-7806F9A6E2DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.58\",\"matchCriteriaId\":\"6B9489BC-825E-4EEE-8D93-F93C801988C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.5\",\"matchCriteriaId\":\"6E62D61A-F704-44DB-A311-17B7534DA7BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12cf028381aa19bc38465341512c280256e8d82d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a941f3d5b1469c60a7e70e775584f110b47e0d16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e11ce03b58743bf1e096c48fcaa7e6f08eb75dfa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T18:33:11+00:00",
      "cve": "CVE-2024-50088",
      "id": "CVE-2024-50088",
      "initial_release_date": "2024-10-29T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix uninitialized pointer free in add_inode_ref()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50088.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:43:58Z",
      "cve": "CVE-2024-50088",
      "id": "CVE-2024-50088",
      "initial_release_date": "2024-10-29T04:15:35Z",
      "product_status:known_affected": "398",
      "product_status:known_not_affected": "474",
      "product_status:recommended": "364",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50088",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50088.json",
      "version": "61"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:25:21.785Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50088\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:23:09.128991Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-824\", \"description\": \"CWE-824 Access of Uninitialized Pointer\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:13:54.321Z\"}}], \"cna\": {\"title\": \"btrfs: fix uninitialized pointer free in add_inode_ref()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1cf474cd474bc5d3ef63086ffd009a87a5b7bb2e\", \"lessThan\": \"12cf028381aa19bc38465341512c280256e8d82d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e43eec81c5167b655b72c781b0e75e62a05e415e\", \"lessThan\": \"e11ce03b58743bf1e096c48fcaa7e6f08eb75dfa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e43eec81c5167b655b72c781b0e75e62a05e415e\", \"lessThan\": \"a941f3d5b1469c60a7e70e775584f110b47e0d16\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e43eec81c5167b655b72c781b0e75e62a05e415e\", \"lessThan\": \"66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.1.57\", \"lessThan\": \"6.1.114\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/btrfs/tree-log.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.114\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.58\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/tree-log.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/12cf028381aa19bc38465341512c280256e8d82d\"}, {\"url\": \"https://git.kernel.org/stable/c/e11ce03b58743bf1e096c48fcaa7e6f08eb75dfa\"}, {\"url\": \"https://git.kernel.org/stable/c/a941f3d5b1469c60a7e70e775584f110b47e0d16\"}, {\"url\": \"https://git.kernel.org/stable/c/66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix uninitialized pointer free in add_inode_ref()\\n\\nThe add_inode_ref() function does not initialize the \\\"name\\\" struct when\\nit is declared.  If any of the following calls to \\\"read_one_inode()\\nreturns NULL,\\n\\n\\tdir = read_one_inode(root, parent_objectid);\\n\\tif (!dir) {\\n\\t\\tret = -ENOENT;\\n\\t\\tgoto out;\\n\\t}\\n\\n\\tinode = read_one_inode(root, inode_objectid);\\n\\tif (!inode) {\\n\\t\\tret = -EIO;\\n\\t\\tgoto out;\\n\\t}\\n\\nthen \\\"name.name\\\" would be freed on \\\"out\\\" before being initialized.\\n\\nout:\\n\\t...\\n\\tkfree(name.name);\\n\\nThis issue was reported by Coverity with CID 1526744.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.114\", \"versionStartIncluding\": \"6.1.57\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.58\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.5\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:54:28.868Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50088\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:54:28.868Z\", \"dateReserved\": \"2024-10-21T19:36:19.942Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-29T00:50:31.362Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.