CVE-2024-53146
This vulnerability is an integer overflow in the Linux kernel’s NFSD component that can be triggered by sending a specially crafted request. It occurs when a tag length is too large, causing unsafe arithmetic and potentially crashing the system. The issue has been fixed in a kernel update.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel (any version before the fix) – system administrators and users running affected kernels are impacted.
Real-world impact
An attacker could send a crafted request to the NFSD service, causing the kernel to overflow an integer and crash the system, resulting in a denial of service. No authentication or user interaction is required.
Why this severity
The CVSS score of 9.1 reflects that the flaw is network‑based, requires no privileges, and can completely disrupt availability, making it a critical vulnerability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the NFSD integer‑overflow fix.
- 02Reboot the system to load the updated kernel.
NVD description
Timeline
- Dec 24, 2024 · Dec 24, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/084f797dbc7e52209a…patch
- git.kernel.org/stable/c/3c5f545c9a1f8a1869…patch
- git.kernel.org/stable/c/745f7ce5a95e783ba6…patch
- git.kernel.org/stable/c/7f33b92e5b18e904a4…patch
- git.kernel.org/stable/c/842f1c27a1aef5367e…patch
- git.kernel.org/stable/c/90adbae9dd158da833…patch
- git.kernel.org/stable/c/ccd3394f9a7200d6b0…patch
- git.kernel.org/stable/c/dde654cad08fdaac37…patch
- git.kernel.org/stable/c/de53c5305184ca1333…patch
- lists.debian.org/debian-lts-announce/2025/03…
- lists.debian.org/debian-lts-announce/2025/03…