CVE-2024-46696
A critical flaw in the Linux kernel’s NFS server can let an attacker use a use‑after‑free bug to run arbitrary code. The issue happens when the server releases a delegation reference too early, leaving dangling pointers that can be accessed. The kernel team has fixed the bug in recent updates.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, including all current releases such as 6.11.
Real-world impact
An attacker who can reach the vulnerable NFS service could crash the system, gain root privileges, or otherwise take full control of the affected machine.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable over the network without authentication, and can lead to complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for CVE-2024-46696.
- 02Reboot the system to load the new kernel.
NVD description indicates the vulnerability has been resolved
Timeline
- Sep 13, 2024 · Sep 13, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.