GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-44992 (GCVE-0-2024-44992)

Vulnerability from cvelistv5 – Published: 2024-09-04 19:54 – Updated: 2026-08-05 11:37
VLAI
Title
smb/client: avoid possible NULL dereference in cifs_free_subrequest()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb/client: avoid possible NULL dereference in cifs_free_subrequest() Clang static checker (scan-build) warning: cifsglob.h:line 890, column 3 Access to field 'ops' results in a dereference of a null pointer. Commit 519be989717c ("cifs: Add a tracepoint to track credits involved in R/W requests") adds a check for 'rdata->server', and let clang throw this warning about NULL dereference. When 'rdata->credits.value != 0 && rdata->server == NULL' happens, add_credits_and_wake_if() will call rdata->server->ops->add_credits(). This will cause NULL dereference problem. Add a check for 'rdata->server' to avoid NULL dereference.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-04 20:19 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 69c3c023af25edb5433a2db824d3e7cc328f0183 , < fead60a6d5f84b472b928502a42c419253afe6c1 (git)
Affected: 69c3c023af25edb5433a2db824d3e7cc328f0183 , < 74c2ab6d653b4c2354df65a7f7f2df1925a40a51 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.10.7 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T20:19:34.019685Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T20:19:53.480Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fead60a6d5f84b472b928502a42c419253afe6c1",
              "status": "affected",
              "version": "69c3c023af25edb5433a2db824d3e7cc328f0183",
              "versionType": "git"
            },
            {
              "lessThan": "74c2ab6d653b4c2354df65a7f7f2df1925a40a51",
              "status": "affected",
              "version": "69c3c023af25edb5433a2db824d3e7cc328f0183",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: avoid possible NULL dereference in cifs_free_subrequest()\n\nClang static checker (scan-build) warning:\n\tcifsglob.h:line 890, column 3\n\tAccess to field \u0027ops\u0027 results in a dereference of a null pointer.\n\nCommit 519be989717c (\"cifs: Add a tracepoint to track credits involved in\nR/W requests\") adds a check for \u0027rdata-\u003eserver\u0027, and let clang throw this\nwarning about NULL dereference.\n\nWhen \u0027rdata-\u003ecredits.value != 0 \u0026\u0026 rdata-\u003eserver == NULL\u0027 happens,\nadd_credits_and_wake_if() will call rdata-\u003eserver-\u003eops-\u003eadd_credits().\nThis will cause NULL dereference problem. Add a check for \u0027rdata-\u003eserver\u0027\nto avoid NULL dereference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The precondition for the crash \u2014 `rdata-\u003eserver` being NULL while credits are still held \u2014 is produced by SMB channel teardown paths (`cifs_chan_skip_or_disable()`, channel reconnect/disable) that are driven by the remote SMB server\u0027s responses and multichannel advertisements, so a malicious, compromised, or MITM\u0027d SMB server reached over the network controls the trigger against a mounted client.\nAC:L - A hostile server controls both sides: it drives the reconnect/multichannel-disable that NULLs the channel and it controls response timing, so it can stall in-flight R/W subrequests to hold credits across the window at will. No memory-layout or victim-state condition outside the attacker\u0027s influence is needed.\nPR:N - A remote SMB server needs no account, credentials, or privileges on the victim client \u2014 the reconnect and channel-negotiation behaviour it abuses is part of normal connection maintenance on an established mount.\nUI:N - Against the common deployment of a persistent SMB mount (fstab/automount on servers, embedded and Android devices), the attacker acts on an already-mounted share with ordinary background readahead and writeback supplying the I/O; no victim action is required at attack time.\nS:U - The fault occurs in the CIFS client inside the kernel and its consequences stay within that same kernel\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a dereference of a NULL `server` pointer to reach `server-\u003eops`, which faults immediately; no out-of-bounds or freed memory is read and no data is returned to the attacker.\nI:N - Nothing is written through the bad pointer \u2014 the code path faults on the read of `-\u003eops` before any store, giving no write primitive or control-flow hijack on configurations with the standard non-zero `mmap_min_addr` and SMAP/PAN.\nA:H - The NULL dereference oopses the kernel in netfs subrequest-completion context, which is frequently a workqueue, killing writeback and rendering the mount unusable; the remote server can trigger it repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:32.018Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fead60a6d5f84b472b928502a42c419253afe6c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/74c2ab6d653b4c2354df65a7f7f2df1925a40a51"
        }
      ],
      "title": "smb/client: avoid possible NULL dereference in cifs_free_subrequest()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44992",
    "datePublished": "2024-09-04T19:54:38.878Z",
    "dateReserved": "2024-08-21T05:34:56.671Z",
    "dateUpdated": "2026-08-05T11:37:32.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-44992",
      "date": "2026-09-20",
      "epss": "0.00435",
      "percentile": "0.37235"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/file.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "fead60a6d5f84b472b928502a42c419253afe6c1",
                    "status": "affected",
                    "version": "69c3c023af25edb5433a2db824d3e7cc328f0183",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "74c2ab6d653b4c2354df65a7f7f2df1925a40a51",
                    "status": "affected",
                    "version": "69c3c023af25edb5433a2db824d3e7cc328f0183",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/file.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.10"
                  },
                  {
                    "lessThan": "6.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.11",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E55C1263-DF43-41EF-8DA8-2BA68DF4FFFD",
                    "versionEndExcluding": "6.10.7",
                    "versionStartIncluding": "6.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: avoid possible NULL dereference in cifs_free_subrequest()\n\nClang static checker (scan-build) warning:\n\tcifsglob.h:line 890, column 3\n\tAccess to field \u0027ops\u0027 results in a dereference of a null pointer.\n\nCommit 519be989717c (\"cifs: Add a tracepoint to track credits involved in\nR/W requests\") adds a check for \u0027rdata-\u003eserver\u0027, and let clang throw this\nwarning about NULL dereference.\n\nWhen \u0027rdata-\u003ecredits.value != 0 \u0026\u0026 rdata-\u003eserver == NULL\u0027 happens,\nadd_credits_and_wake_if() will call rdata-\u003eserver-\u003eops-\u003eadd_credits().\nThis will cause NULL dereference problem. Add a check for \u0027rdata-\u003eserver\u0027\nto avoid NULL dereference."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb/client: evitar posible desreferencia NULL en cifs_free_subrequest() Advertencia del verificador est\u00e1tico de Clang (scan-build): cifsglob.h:l\u00ednea 890, columna 3 El acceso al campo \u0027ops\u0027 da como resultado una desreferencia de un puntero nulo. El commit 519be989717c (\"cifs: Agregar un punto de seguimiento para rastrear cr\u00e9ditos involucrados en solicitudes R/W\") agrega una verificaci\u00f3n para \u0027rdata-\u0026gt;server\u0027 y permite que clang lance esta advertencia sobre la desreferencia NULL. Cuando sucede \u0027rdata-\u0026gt;credits.value != 0 \u0026amp;\u0026amp; rdata-\u0026gt;server == NULL\u0027, add_credits_and_wake_if() llamar\u00e1 a rdata-\u0026gt;server-\u0026gt;ops-\u0026gt;add_credits(). Esto causar\u00e1 un problema de desreferencia NULL. Agregue una verificaci\u00f3n para \u0027rdata-\u0026gt;server\u0027 para evitar la desreferencia NULL."
          }
        ],
        "id": "CVE-2024-44992",
        "lastModified": "2026-08-04T11:20:07.747",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-44992",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T20:19:34.019685Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-09-04T20:15:08.207",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/74c2ab6d653b4c2354df65a7f7f2df1925a40a51"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fead60a6d5f84b472b928502a42c419253afe6c1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T08:43:44+00:00",
      "cve": "CVE-2024-44992",
      "id": "CVE-2024-44992",
      "initial_release_date": "2024-09-04T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb/client: avoid possible NULL dereference in cifs_free_subrequest()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-44992.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-44992",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-04T20:19:34.019685Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-04T20:19:37.936Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/smb/client/file.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "fead60a6d5f84b472b928502a42c419253afe6c1",
                  "status": "affected",
                  "version": "69c3c023af25edb5433a2db824d3e7cc328f0183",
                  "versionType": "git"
                },
                {
                  "lessThan": "74c2ab6d653b4c2354df65a7f7f2df1925a40a51",
                  "status": "affected",
                  "version": "69c3c023af25edb5433a2db824d3e7cc328f0183",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/smb/client/file.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.10"
                },
                {
                  "lessThan": "6.10",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.11",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: avoid possible NULL dereference in cifs_free_subrequest()\n\nClang static checker (scan-build) warning:\n\tcifsglob.h:line 890, column 3\n\tAccess to field \u0027ops\u0027 results in a dereference of a null pointer.\n\nCommit 519be989717c (\"cifs: Add a tracepoint to track credits involved in\nR/W requests\") adds a check for \u0027rdata-\u003eserver\u0027, and let clang throw this\nwarning about NULL dereference.\n\nWhen \u0027rdata-\u003ecredits.value != 0 \u0026\u0026 rdata-\u003eserver == NULL\u0027 happens,\nadd_credits_and_wake_if() will call rdata-\u003eserver-\u003eops-\u003eadd_credits().\nThis will cause NULL dereference problem. Add a check for \u0027rdata-\u003eserver\u0027\nto avoid NULL dereference."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-12-19T09:19:48.405Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/fead60a6d5f84b472b928502a42c419253afe6c1"
            },
            {
              "url": "https://git.kernel.org/stable/c/74c2ab6d653b4c2354df65a7f7f2df1925a40a51"
            }
          ],
          "title": "smb/client: avoid possible NULL dereference in cifs_free_subrequest()",
          "x_generator": {
            "engine": "bippy-5f407fcff5a0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-44992",
        "datePublished": "2024-09-04T19:54:38.878Z",
        "dateReserved": "2024-08-21T05:34:56.671Z",
        "dateUpdated": "2024-12-19T09:19:48.405Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.