CVE-2024-50106
A critical race condition in the Linux kernel’s NFS server can cause a use‑after‑free error, potentially crashing the system or allowing privilege escalation. The flaw occurs when a revoked delegation is freed while another thread is still processing it, leading to a kernel crash. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel 6.12 and earlier, especially systems running the NFS server (nfsd).
Real-world impact
An attacker could trigger a kernel crash or gain elevated privileges by exploiting the use‑after‑free condition in the NFS server.
Why this severity
The CVSS score of 9.8 reflects the high impact on confidentiality, integrity, and availability, and the fact that the vulnerability can be exploited remotely without authentication or user interaction.
What to do about it
- 01Upgrade your Linux kernel to version 6.12 or later, which includes the fix for the NFS stateid race condition.
- 02Reboot or restart services to load the new kernel.
NVD description indicates the issue has been resolved in recent kernel releases.
Timeline
- Nov 5, 2024 · Nov 5, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.