CVE-2024-49996
A critical buffer overflow in the Linux kernel's CIFS implementation can allow attackers to crash or potentially execute code. The flaw occurs when parsing NFS reparse points due to an incorrect length calculation. A patch has been released to fix the issue.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, including Debian 11.0 and other distributions that use the affected kernel version.
Real-world impact
An attacker could crash the system or potentially run arbitrary code, leading to denial of service or compromise.
Why this severity
The CVSS score of 9.4 reflects the high impact: the vulnerability is exploitable over the network, requires no privileges, and can lead to complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a patched version that resolves the buffer overflow in CIFS reparse point parsing.
NVD-referenced vendor advisory
Timeline
- Oct 21, 2024 · Oct 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/01cdddde39b065074f…patch
- git.kernel.org/stable/c/73b078e3314d4854fd…patch
- git.kernel.org/stable/c/7b222d6cb87077faf5…patch
- git.kernel.org/stable/c/803b3a39cb096d8718…patch
- git.kernel.org/stable/c/c173d47b69f07cd7ca…patch
- git.kernel.org/stable/c/c6db81c550cea0c73b…patch
- git.kernel.org/stable/c/e2a8910af01653c1c2…patch
- git.kernel.org/stable/c/ec79e6170bcae8a603…patch
- lists.debian.org/debian-lts-announce/2025/03…mailing listthird party advisory
- lists.debian.org/debian-lts-announce/2025/03…mailing listthird party advisory