CVE-2024-53177
A critical memory corruption bug in the Linux kernel’s SMB/CIFS file system can allow attackers to cause a use‑after‑free, potentially leading to arbitrary code execution. The flaw occurs when the kernel processes a lease break while freeing cached directory data. It has been fixed in newer kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, any distribution using the affected kernel version, especially those that use SMB/CIFS file sharing.
Real-world impact
An attacker could crash the kernel or execute arbitrary code with kernel privileges, potentially taking control of the affected system.
Why this severity
The CVSS score of 9.8 reflects the lack of authentication or user interaction required, the high impact on confidentiality, integrity, and availability, and the use‑after‑free vulnerability that can lead to arbitrary code execution.
What to do about it
- 01Check the current kernel version on the system.
- 02Update the Linux kernel to a version that includes the CVE‑2024‑53177 fix (any kernel released after the patch).
- 03Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Dec 27, 2024 · Dec 27, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.