CVE-2024-50162
The vulnerability is a NULL pointer dereference in the Linux kernel's BPF devmap redirect functionality that can be triggered by a local attacker, leading to a kernel crash and possible privilege escalation. The issue has been resolved in the kernel source; applying the appropriate kernel update mitigates the risk.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users
Real-world impact
Kernel panic / denial of service
Why this severity
CVSS 9.8 (Critical) due to network‑adjacent attack vector, low complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability.
What to do about it
- 011. Obtain the latest Linux kernel update from your distribution that includes the fix for CVE-2024-50162.
- 022. Install or upgrade the kernel package using your system's package manager (e.g., apt, yum, dnf, zypper).
- 033. Reboot the system to load the patched kernel.
NVD-referenced vendor advisory (the NVD description states the vulnerability has been resolved in the Linux kernel).
Timeline
- Nov 7, 2024 · Nov 7, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.