CVE-2024-46695
A flaw in the Linux kernel allows a root user on an NFS client to bypass security permission checks when changing file labels on an NFS filesystem. This occurs even when 'root squashing' is enabled, which is a security feature intended to limit root user privileges on network shares.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running the Linux kernel, specifically version 6.11, who utilize NFS filesystems.
Real-world impact
An attacker with root access on a network client could modify the security labels of files on a shared filesystem, potentially bypassing intended access controls and security policies.
Why this severity
The critical score reflects that the vulnerability can be exploited remotely over a network without requiring user interaction or special privileges, potentially leading to a total loss of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix for CVE-2024-46695.
NVD-referenced vendor advisory
Timeline
- Sep 13, 2024 · Sep 13, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/2dbc4b7bac60b02cc6…
- git.kernel.org/stable/c/459584258d47ec3cc6…patch
- git.kernel.org/stable/c/76a0e79bc84f466999…patch
- git.kernel.org/stable/c/eebec98791d0137e45…
- git.kernel.org/stable/c/f71ec019257ba4f7ab…patch
- git.kernel.org/stable/c/fe0cd53791119f6287…
- lists.debian.org/debian-lts-announce/2025/01…
- lists.debian.org/debian-lts-announce/2025/03…