CVE-2024-49855
A critical flaw in the Linux kernel’s NBD (Network Block Device) subsystem allows attackers to race a timeout with a normal completion, leading to a use‑after‑free. This can let an attacker execute arbitrary code or crash the system. The issue has been fixed in newer kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, especially versions 5.17.15 and earlier that include the NBD module.
Real-world impact
An attacker could trigger the race condition to cause the kernel to free memory that is still in use, potentially allowing them to execute arbitrary code or cause a denial of service.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely with no authentication, no user interaction, and can compromise confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to version 5.17.15 or later.
- 02Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Oct 21, 2024 · Oct 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.