CVE-2024-53066
A bug in the Linux kernel’s NFS code could let an attacker read uninitialized memory or cause a crash. The issue was fixed by initializing a variable in the kernel’s NFS attribute handling. Users should update to a patched kernel version.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, especially versions prior to 6.12, used on servers, desktops, and embedded devices that run NFS.
Real-world impact
An attacker could trigger the bug to cause a denial‑of‑service crash or potentially leak sensitive data from uninitialized memory, affecting the confidentiality, integrity, and availability of the system.
Why this severity
The CVSS score of 9.8 reflects that the flaw can be exploited remotely without authentication, and it compromises confidentiality, integrity, and availability, making it a critical vulnerability.
What to do about it
- 01Upgrade the Linux kernel to version 6.12 or later, which contains the patch that initializes the NFS attribute variable.
- 02Reboot the system to load the updated kernel.
NVD description indicates the issue has been resolved in the kernel.
Timeline
- Nov 19, 2024 · Nov 19, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/25ffd294fef81a7f3c…patch
- git.kernel.org/stable/c/8fc5ea9231af9122d2…patch
- git.kernel.org/stable/c/9b453e8b108a5a93a6…patch
- git.kernel.org/stable/c/9be0a21ae52b3b822d…patch
- git.kernel.org/stable/c/bbfcd261cc068fe1cd…patch
- git.kernel.org/stable/c/dc270d7159699ad6d1…patch
- git.kernel.org/stable/c/f6b2b2b981af8e7d7c…patch
- git.kernel.org/stable/c/f749cb60a01f8391c7…patch
- lists.debian.org/debian-lts-announce/2025/01…
- lists.debian.org/debian-lts-announce/2025/03…