GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49855 (GCVE-0-2024-49855)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:18 – Updated: 2026-08-05 11:40
VLAI
Title
nbd: fix race between timeout and normal completion
Summary
In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between timeout and normal completion If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered. Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime make sure that cmd->lock is grabbed for clearing the flag and the requeue.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 12:56 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2895f1831e911ca87d4efdf43e35eb72a0c7e66e , < 9c25faf72d780a9c71081710cd48759d61ff6e9b (git)
Affected: 2895f1831e911ca87d4efdf43e35eb72a0c7e66e , < 6e73b946a379a1dfbb62626af93843bdfb53753d (git)
Affected: 2895f1831e911ca87d4efdf43e35eb72a0c7e66e , < 5236ada8ebbd9e7461f17477357582f5be4f46f7 (git)
Affected: 2895f1831e911ca87d4efdf43e35eb72a0c7e66e , < 9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc (git)
Affected: 2895f1831e911ca87d4efdf43e35eb72a0c7e66e , < c9ea57c91f03bcad415e1a20113bdb2077bcf990 (git)
Affected: cdf62c535a9bfd5ff0eef4b91669da39d8abc0c3 (git)
Affected: 5171ef20bae852ff38f4cfdb368bcdcc744776d0 (git)
Affected: 5.17.15 , < 5.18 (semver)
Affected: 5.18.4 , < 5.19 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49855",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:56:24.992815Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:11.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:22:24.136Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/nbd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c25faf72d780a9c71081710cd48759d61ff6e9b",
              "status": "affected",
              "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
              "versionType": "git"
            },
            {
              "lessThan": "6e73b946a379a1dfbb62626af93843bdfb53753d",
              "status": "affected",
              "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
              "versionType": "git"
            },
            {
              "lessThan": "5236ada8ebbd9e7461f17477357582f5be4f46f7",
              "status": "affected",
              "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
              "versionType": "git"
            },
            {
              "lessThan": "9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc",
              "status": "affected",
              "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
              "versionType": "git"
            },
            {
              "lessThan": "c9ea57c91f03bcad415e1a20113bdb2077bcf990",
              "status": "affected",
              "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cdf62c535a9bfd5ff0eef4b91669da39d8abc0c3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5171ef20bae852ff38f4cfdb368bcdcc744776d0",
              "versionType": "git"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.15",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/nbd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between timeout and normal completion\n\nIf request timetout is handled by nbd_requeue_cmd(), normal completion\nhas to be stopped for avoiding to complete this requeued request, other\nuse-after-free can be triggered.\n\nFix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime\nmake sure that cmd-\u003elock is grabbed for clearing the flag and the\nrequeue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The race is driven by the NBD reply stream received over TCP in `recv_work()`/`nbd_handle_reply()`, code that processes data from a remote peer; a malicious or compromised NBD server \u2014 or an on-path attacker, since the NBD protocol is plaintext and unauthenticated on port 10809 \u2014 controls reply timing and content.\nAC:L - The remote server controls both sides of the race: it withholds a reply to force `nbd_xmit_timeout()` to fire, then delivers the reply at that instant to collide with `nbd_requeue_cmd()`, and it can repeat this across many in-flight requests indefinitely at no cost.\nPR:N - The NBD protocol carries no authentication, so the attacking server or MITM needs no credentials or privileges on the victim host; the CAP_SYS_ADMIN gate only covers the victim admin\u0027s own legitimate `nbd-client` setup, which is a pre-existing deployment condition rather than an attacker privilege.\nUI:N - No victim action is needed at attack time \u2014 an already-established NBD session (diskless boot, cloud block storage) is enough, and a compromised server or on-path attacker triggers the race unilaterally.\nS:U - The use-after-free and block-layer corruption stay within the kernel of the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Re-dispatching an already-completed request makes `nbd_send_cmd()` walk freed bio/bvec memory and transmit its contents over the socket to the attacker-controlled server, directly disclosing freed kernel/page-cache data.\nI:H - A re-dispatched READ writes the server\u0027s attacker-chosen reply payload into freed and possibly reallocated pages, and the requeue of a reused request corrupts `q-\u003erequeue_list`/`rq-\u003equeuelist` \u2014 a controlled write primitive usable for control-flow hijacking.\nA:H - The double completion and requeue of a freed/reused request reliably produce list corruption, KASAN use-after-free splats, oops, or hang of the storage path and the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:05.597Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c25faf72d780a9c71081710cd48759d61ff6e9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e73b946a379a1dfbb62626af93843bdfb53753d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5236ada8ebbd9e7461f17477357582f5be4f46f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9ea57c91f03bcad415e1a20113bdb2077bcf990"
        }
      ],
      "title": "nbd: fix race between timeout and normal completion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49855",
    "datePublished": "2024-10-21T12:18:47.391Z",
    "dateReserved": "2024-10-21T12:17:06.016Z",
    "dateUpdated": "2026-08-05T11:40:05.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49855",
      "date": "2026-09-19",
      "epss": "0.00463",
      "percentile": "0.3938"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C681E105-4A0C-49A5-9351-D60E86303ED3",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.18.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7D848431-3C7A-4C40-BC35-515047E89ABE",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D448821D-C085-4CAF-88FA-2DDE7BE21976",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CE94BB8D-B0AB-4563-9ED7-A12122B56EBE",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:5.17.15:*:*:*:*:*:*:*",
                  "matchCriteriaId": "EECD1046-480D-4996-83EB-3406D178BA84",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between timeout and normal completion\n\nIf request timetout is handled by nbd_requeue_cmd(), normal completion\nhas to be stopped for avoiding to complete this requeued request, other\nuse-after-free can be triggered.\n\nFix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime\nmake sure that cmd-\u003elock is grabbed for clearing the flag and the\nrequeue."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nbd: se corrige la ejecuci\u00f3n entre el tiempo de espera y la finalizaci\u00f3n normal. Si el tiempo de espera de la solicitud lo maneja nbd_requeue_cmd(), la finalizaci\u00f3n normal debe detenerse para evitar completar esta solicitud en cola; se pueden activar otros use after free. Corrija la ejecuci\u00f3n borrando NBD_CMD_INFLIGHT en nbd_requeue_cmd(); mientras tanto, aseg\u00farese de que cmd-\u0026gt;lock se captura para borrar la bandera y la puesta en cola."
        }
      ],
      "id": "CVE-2024-49855",
      "lastModified": "2024-10-22T16:12:27.030",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.0,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.0,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-21T13:15:06.270",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/5236ada8ebbd9e7461f17477357582f5be4f46f7"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6e73b946a379a1dfbb62626af93843bdfb53753d"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/9c25faf72d780a9c71081710cd48759d61ff6e9b"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/c9ea57c91f03bcad415e1a20113bdb2077bcf990"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/block/nbd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9c25faf72d780a9c71081710cd48759d61ff6e9b",
                    "status": "affected",
                    "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6e73b946a379a1dfbb62626af93843bdfb53753d",
                    "status": "affected",
                    "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5236ada8ebbd9e7461f17477357582f5be4f46f7",
                    "status": "affected",
                    "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc",
                    "status": "affected",
                    "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c9ea57c91f03bcad415e1a20113bdb2077bcf990",
                    "status": "affected",
                    "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "cdf62c535a9bfd5ff0eef4b91669da39d8abc0c3",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "5171ef20bae852ff38f4cfdb368bcdcc744776d0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "affected",
                    "version": "5.17.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "affected",
                    "version": "5.18.4",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/block/nbd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C681E105-4A0C-49A5-9351-D60E86303ED3",
                    "versionEndExcluding": "5.19",
                    "versionStartIncluding": "5.18.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7D848431-3C7A-4C40-BC35-515047E89ABE",
                    "versionEndExcluding": "6.1.113",
                    "versionStartIncluding": "5.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D448821D-C085-4CAF-88FA-2DDE7BE21976",
                    "versionEndExcluding": "6.6.54",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CE94BB8D-B0AB-4563-9ED7-A12122B56EBE",
                    "versionEndExcluding": "6.10.13",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181",
                    "versionEndExcluding": "6.11.2",
                    "versionStartIncluding": "6.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.17.15:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EECD1046-480D-4996-83EB-3406D178BA84",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between timeout and normal completion\n\nIf request timetout is handled by nbd_requeue_cmd(), normal completion\nhas to be stopped for avoiding to complete this requeued request, other\nuse-after-free can be triggered.\n\nFix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime\nmake sure that cmd-\u003elock is grabbed for clearing the flag and the\nrequeue."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nbd: se corrige la ejecuci\u00f3n entre el tiempo de espera y la finalizaci\u00f3n normal. Si el tiempo de espera de la solicitud lo maneja nbd_requeue_cmd(), la finalizaci\u00f3n normal debe detenerse para evitar completar esta solicitud en cola; se pueden activar otros use after free. Corrija la ejecuci\u00f3n borrando NBD_CMD_INFLIGHT en nbd_requeue_cmd(); mientras tanto, aseg\u00farese de que cmd-\u0026gt;lock se captura para borrar la bandera y la puesta en cola."
          }
        ],
        "id": "CVE-2024-49855",
        "lastModified": "2026-08-04T11:20:51.210",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-49855",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:56:24.992815Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-21T13:15:06.270",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5236ada8ebbd9e7461f17477357582f5be4f46f7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6e73b946a379a1dfbb62626af93843bdfb53753d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9c25faf72d780a9c71081710cd48759d61ff6e9b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c9ea57c91f03bcad415e1a20113bdb2077bcf990"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T10:04:14+00:00",
      "cve": "CVE-2024-49855",
      "id": "CVE-2024-49855",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "122",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nbd: fix race between timeout and normal completion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49855.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T00:30:12Z",
      "cve": "CVE-2024-49855",
      "id": "CVE-2024-49855",
      "initial_release_date": "2024-10-21T15:45:41Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "381",
      "product_status:recommended": "659",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49855",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49855.json",
      "version": "74"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T22:22:24.136Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-49855",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-21T12:56:24.992815Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-21T12:56:28.122Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/block/nbd.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "9c25faf72d780a9c71081710cd48759d61ff6e9b",
                  "status": "affected",
                  "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
                  "versionType": "git"
                },
                {
                  "lessThan": "6e73b946a379a1dfbb62626af93843bdfb53753d",
                  "status": "affected",
                  "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
                  "versionType": "git"
                },
                {
                  "lessThan": "5236ada8ebbd9e7461f17477357582f5be4f46f7",
                  "status": "affected",
                  "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
                  "versionType": "git"
                },
                {
                  "lessThan": "9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc",
                  "status": "affected",
                  "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
                  "versionType": "git"
                },
                {
                  "lessThan": "c9ea57c91f03bcad415e1a20113bdb2077bcf990",
                  "status": "affected",
                  "version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "cdf62c535a9bfd5ff0eef4b91669da39d8abc0c3",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "5171ef20bae852ff38f4cfdb368bcdcc744776d0",
                  "versionType": "git"
                },
                {
                  "lessThan": "5.18",
                  "status": "affected",
                  "version": "5.17.15",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.19",
                  "status": "affected",
                  "version": "5.18.4",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/block/nbd.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.19"
                },
                {
                  "lessThan": "5.19",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.113",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.54",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.13",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.113",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.54",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.13",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.2",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.17.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.18.4",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between timeout and normal completion\n\nIf request timetout is handled by nbd_requeue_cmd(), normal completion\nhas to be stopped for avoiding to complete this requeued request, other\nuse-after-free can be triggered.\n\nFix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime\nmake sure that cmd-\u003elock is grabbed for clearing the flag and the\nrequeue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The race is driven by the NBD reply stream received over TCP in `recv_work()`/`nbd_handle_reply()`, code that processes data from a remote peer; a malicious or compromised NBD server \u2014 or an on-path attacker, since the NBD protocol is plaintext and unauthenticated on port 10809 \u2014 controls reply timing and content.\nAC:L - The remote server controls both sides of the race: it withholds a reply to force `nbd_xmit_timeout()` to fire, then delivers the reply at that instant to collide with `nbd_requeue_cmd()`, and it can repeat this across many in-flight requests indefinitely at no cost.\nPR:N - The NBD protocol carries no authentication, so the attacking server or MITM needs no credentials or privileges on the victim host; the CAP_SYS_ADMIN gate only covers the victim admin\u0027s own legitimate `nbd-client` setup, which is a pre-existing deployment condition rather than an attacker privilege.\nUI:N - No victim action is needed at attack time \u2014 an already-established NBD session (diskless boot, cloud block storage) is enough, and a compromised server or on-path attacker triggers the race unilaterally.\nS:U - The use-after-free and block-layer corruption stay within the kernel of the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Re-dispatching an already-completed request makes `nbd_send_cmd()` walk freed bio/bvec memory and transmit its contents over the socket to the attacker-controlled server, directly disclosing freed kernel/page-cache data.\nI:H - A re-dispatched READ writes the server\u0027s attacker-chosen reply payload into freed and possibly reallocated pages, and the requeue of a reused request corrupts `q-\u003erequeue_list`/`rq-\u003equeuelist` \u2014 a controlled write primitive usable for control-flow hijacking.\nA:H - The double completion and requeue of a freed/reused request reliably produce list corruption, KASAN use-after-free splats, oops, or hang of the storage path and the machine."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:40:05.597Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/9c25faf72d780a9c71081710cd48759d61ff6e9b"
            },
            {
              "url": "https://git.kernel.org/stable/c/6e73b946a379a1dfbb62626af93843bdfb53753d"
            },
            {
              "url": "https://git.kernel.org/stable/c/5236ada8ebbd9e7461f17477357582f5be4f46f7"
            },
            {
              "url": "https://git.kernel.org/stable/c/9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc"
            },
            {
              "url": "https://git.kernel.org/stable/c/c9ea57c91f03bcad415e1a20113bdb2077bcf990"
            }
          ],
          "title": "nbd: fix race between timeout and normal completion",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-49855",
        "datePublished": "2024-10-21T12:18:47.391Z",
        "dateReserved": "2024-10-21T12:17:06.016Z",
        "dateUpdated": "2026-08-05T11:40:05.597Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.