CVE-2024-46696
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In the Linux kernel, the NFS server (nfsd) has a use-after-free (UAF) vulnerability in nfsd4_cb_getattr_release. After dropping the delegation reference, accessing its embedded fields is unsafe. The fix moves the release to the end.
Risk Assessment
An attacker could exploit this vulnerability to cause a system crash or potentially execute arbitrary code in kernel context, leading to full system compromise.
Recommendation
Immediately update the Linux kernel to a version containing the fix for CVE-2024-46696. Monitor vendor distributions for patches.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix potential UAF in nfsd4_cb_getattr_release Once we drop the delegation reference, the fields embedded in it are no longer safe to access. Do that last.