CVE-2024-49855
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In the Linux kernel, the nbd module has a race between timeout and normal completion. If timeout is handled by nbd_requeue_cmd(), normal completion must be stopped to avoid use-after-free. The fix clears NBD_CMD_INFLIGHT in nbd_requeue_cmd() and ensures cmd->lock is grabbed before clearing the flag and requeueing.
Risk Assessment
An attacker could exploit the race to cause a system crash or potentially execute arbitrary code in kernel context.
Recommendation
Update the Linux kernel to a patched version. Also monitor for similar races in other drivers.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between timeout and normal completion If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered. Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime make sure that cmd->lock is grabbed for clearing the flag and the requeue.