CVE-2024-50047
A vulnerability in the Linux kernel's SMB client allows for a 'use-after-free' error during asynchronous decryption of large files. This occurs because the system incorrectly manages memory when performing parallel decryption tasks.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running the Linux kernel, specifically when using the SMB client for large file reads with asynchronous decryption.
Real-world impact
An attacker could trigger a system crash, leading to a denial of service, by sending specific data during a large file read operation.
Why this severity
The critical score reflects that the vulnerability can be exploited remotely over a network without authentication or user interaction, potentially leading to a complete loss of system availability.
What to do about it
- 01Apply the fix to the Linux kernel that allocates a new AEAD TFM for async decryption to prevent memory corruption.
NVD-referenced vendor advisory
Timeline
- Oct 21, 2024 · Oct 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/0809fb86ad13b29e1d…patch
- git.kernel.org/stable/c/538c26d9bf70c90edc…patch
- git.kernel.org/stable/c/8f14a476abba13144d…
- git.kernel.org/stable/c/b0abcd65ec545701b8…patch
- git.kernel.org/stable/c/bce966530fd5542bbb…
- git.kernel.org/stable/c/ef51c0d544b1518b35…
- lists.debian.org/debian-lts-announce/2025/03…
- lists.debian.org/debian-lts-announce/2025/05…