CVE-2024-46690
A flaw in the Linux kernel’s NFS daemon can cause the system to crash or potentially allow arbitrary code execution when handling certain lease requests. The bug involves an unsafe pointer dereference that was not properly checked. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users, especially those running version 6.11 or later that include the NFS server component. System administrators and operators of Linux servers that export or mount NFS shares are affected.
Real-world impact
An attacker who can send crafted NFS requests could crash the NFS service, leading to a denial of service. If the memory corruption is exploited further, it could allow the attacker to execute arbitrary code on the server.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited over the network with no authentication or user interaction, and it compromises confidentiality, integrity, and availability of the affected system.
What to do about it
- 011. Update the Linux kernel to version 6.11 or later, which contains the patch for the NFS daemon.
- 022. Reboot the system or reload the kernel to apply the update.
NVD description indicates the issue has been resolved in kernel 6.11
Timeline
- Sep 13, 2024 · Sep 13, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.