CVE-2024-49855 (GCVE-0-2024-49855)
Vulnerability from cvelistv5 – Published: 2024-10-21 12:18 – Updated: 2026-08-05 11:40
VLAI
EPSS
VEX
Title
nbd: fix race between timeout and normal completion
Summary
In the Linux kernel, the following vulnerability has been resolved:
nbd: fix race between timeout and normal completion
If request timetout is handled by nbd_requeue_cmd(), normal completion
has to be stopped for avoiding to complete this requeued request, other
use-after-free can be triggered.
Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime
make sure that cmd->lock is grabbed for clearing the flag and the
requeue.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 12:56 UTC
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
2895f1831e911ca87d4efdf43e35eb72a0c7e66e , < 9c25faf72d780a9c71081710cd48759d61ff6e9b
(git)
Affected: 2895f1831e911ca87d4efdf43e35eb72a0c7e66e , < 6e73b946a379a1dfbb62626af93843bdfb53753d (git) Affected: 2895f1831e911ca87d4efdf43e35eb72a0c7e66e , < 5236ada8ebbd9e7461f17477357582f5be4f46f7 (git) Affected: 2895f1831e911ca87d4efdf43e35eb72a0c7e66e , < 9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc (git) Affected: 2895f1831e911ca87d4efdf43e35eb72a0c7e66e , < c9ea57c91f03bcad415e1a20113bdb2077bcf990 (git) Affected: cdf62c535a9bfd5ff0eef4b91669da39d8abc0c3 (git) Affected: 5171ef20bae852ff38f4cfdb368bcdcc744776d0 (git) Affected: 5.17.15 , < 5.18 (semver) Affected: 5.18.4 , < 5.19 (semver) |
guessed | |
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.113 , ≤ 6.1.* (semver) Unaffected: 6.6.54 , ≤ 6.6.* (semver) Unaffected: 6.10.13 , ≤ 6.10.* (semver) Unaffected: 6.11.2 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-49855",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-21T12:56:24.992815Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-21T13:04:11.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:22:24.136Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/nbd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9c25faf72d780a9c71081710cd48759d61ff6e9b",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "6e73b946a379a1dfbb62626af93843bdfb53753d",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "5236ada8ebbd9e7461f17477357582f5be4f46f7",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "c9ea57c91f03bcad415e1a20113bdb2077bcf990",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"status": "affected",
"version": "cdf62c535a9bfd5ff0eef4b91669da39d8abc0c3",
"versionType": "git"
},
{
"status": "affected",
"version": "5171ef20bae852ff38f4cfdb368bcdcc744776d0",
"versionType": "git"
},
{
"lessThan": "5.18",
"status": "affected",
"version": "5.17.15",
"versionType": "semver"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/nbd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.10.*",
"status": "unaffected",
"version": "6.10.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.113",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.54",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.10.13",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.2",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between timeout and normal completion\n\nIf request timetout is handled by nbd_requeue_cmd(), normal completion\nhas to be stopped for avoiding to complete this requeued request, other\nuse-after-free can be triggered.\n\nFix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime\nmake sure that cmd-\u003elock is grabbed for clearing the flag and the\nrequeue."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The race is driven by the NBD reply stream received over TCP in `recv_work()`/`nbd_handle_reply()`, code that processes data from a remote peer; a malicious or compromised NBD server \u2014 or an on-path attacker, since the NBD protocol is plaintext and unauthenticated on port 10809 \u2014 controls reply timing and content.\nAC:L - The remote server controls both sides of the race: it withholds a reply to force `nbd_xmit_timeout()` to fire, then delivers the reply at that instant to collide with `nbd_requeue_cmd()`, and it can repeat this across many in-flight requests indefinitely at no cost.\nPR:N - The NBD protocol carries no authentication, so the attacking server or MITM needs no credentials or privileges on the victim host; the CAP_SYS_ADMIN gate only covers the victim admin\u0027s own legitimate `nbd-client` setup, which is a pre-existing deployment condition rather than an attacker privilege.\nUI:N - No victim action is needed at attack time \u2014 an already-established NBD session (diskless boot, cloud block storage) is enough, and a compromised server or on-path attacker triggers the race unilaterally.\nS:U - The use-after-free and block-layer corruption stay within the kernel of the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Re-dispatching an already-completed request makes `nbd_send_cmd()` walk freed bio/bvec memory and transmit its contents over the socket to the attacker-controlled server, directly disclosing freed kernel/page-cache data.\nI:H - A re-dispatched READ writes the server\u0027s attacker-chosen reply payload into freed and possibly reallocated pages, and the requeue of a reused request corrupts `q-\u003erequeue_list`/`rq-\u003equeuelist` \u2014 a controlled write primitive usable for control-flow hijacking.\nA:H - The double completion and requeue of a freed/reused request reliably produce list corruption, KASAN use-after-free splats, oops, or hang of the storage path and the machine."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:40:05.597Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9c25faf72d780a9c71081710cd48759d61ff6e9b"
},
{
"url": "https://git.kernel.org/stable/c/6e73b946a379a1dfbb62626af93843bdfb53753d"
},
{
"url": "https://git.kernel.org/stable/c/5236ada8ebbd9e7461f17477357582f5be4f46f7"
},
{
"url": "https://git.kernel.org/stable/c/9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc"
},
{
"url": "https://git.kernel.org/stable/c/c9ea57c91f03bcad415e1a20113bdb2077bcf990"
}
],
"title": "nbd: fix race between timeout and normal completion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-49855",
"datePublished": "2024-10-21T12:18:47.391Z",
"dateReserved": "2024-10-21T12:17:06.016Z",
"dateUpdated": "2026-08-05T11:40:05.597Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-49855",
"date": "2026-10-25",
"epss": "0.00463",
"percentile": "0.39886"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/nbd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9c25faf72d780a9c71081710cd48759d61ff6e9b",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "6e73b946a379a1dfbb62626af93843bdfb53753d",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "5236ada8ebbd9e7461f17477357582f5be4f46f7",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "c9ea57c91f03bcad415e1a20113bdb2077bcf990",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"status": "affected",
"version": "cdf62c535a9bfd5ff0eef4b91669da39d8abc0c3",
"versionType": "git"
},
{
"status": "affected",
"version": "5171ef20bae852ff38f4cfdb368bcdcc744776d0",
"versionType": "git"
},
{
"lessThan": "5.18",
"status": "affected",
"version": "5.17.15",
"versionType": "semver"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/nbd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.10.*",
"status": "unaffected",
"version": "6.10.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C681E105-4A0C-49A5-9351-D60E86303ED3",
"versionEndExcluding": "5.19",
"versionStartIncluding": "5.18.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7D848431-3C7A-4C40-BC35-515047E89ABE",
"versionEndExcluding": "6.1.113",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D448821D-C085-4CAF-88FA-2DDE7BE21976",
"versionEndExcluding": "6.6.54",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CE94BB8D-B0AB-4563-9ED7-A12122B56EBE",
"versionEndExcluding": "6.10.13",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181",
"versionEndExcluding": "6.11.2",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.17.15:*:*:*:*:*:*:*",
"matchCriteriaId": "EECD1046-480D-4996-83EB-3406D178BA84",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between timeout and normal completion\n\nIf request timetout is handled by nbd_requeue_cmd(), normal completion\nhas to be stopped for avoiding to complete this requeued request, other\nuse-after-free can be triggered.\n\nFix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime\nmake sure that cmd-\u003elock is grabbed for clearing the flag and the\nrequeue."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nbd: se corrige la ejecuci\u00f3n entre el tiempo de espera y la finalizaci\u00f3n normal. Si el tiempo de espera de la solicitud lo maneja nbd_requeue_cmd(), la finalizaci\u00f3n normal debe detenerse para evitar completar esta solicitud en cola; se pueden activar otros use after free. Corrija la ejecuci\u00f3n borrando NBD_CMD_INFLIGHT en nbd_requeue_cmd(); mientras tanto, aseg\u00farese de que cmd-\u0026gt;lock se captura para borrar la bandera y la puesta en cola."
}
],
"id": "CVE-2024-49855",
"lastModified": "2026-08-04T11:20:51.210",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-49855",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-21T12:56:24.992815Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-10-21T13:15:06.270",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/5236ada8ebbd9e7461f17477357582f5be4f46f7"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/6e73b946a379a1dfbb62626af93843bdfb53753d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/9c25faf72d780a9c71081710cd48759d61ff6e9b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/c9ea57c91f03bcad415e1a20113bdb2077bcf990"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-01T17:20:15+00:00",
"cve": "CVE-2024-49855",
"id": "CVE-2024-49855",
"initial_release_date": "2024-10-21T00:00:00+00:00",
"product_status:known_affected": "122",
"product_status:known_not_affected": "76",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: nbd: fix race between timeout and normal completion",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49855.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:22:24.136Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-49855",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-21T12:56:24.992815Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-21T12:56:28.122Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/nbd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9c25faf72d780a9c71081710cd48759d61ff6e9b",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "6e73b946a379a1dfbb62626af93843bdfb53753d",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "5236ada8ebbd9e7461f17477357582f5be4f46f7",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"lessThan": "c9ea57c91f03bcad415e1a20113bdb2077bcf990",
"status": "affected",
"version": "2895f1831e911ca87d4efdf43e35eb72a0c7e66e",
"versionType": "git"
},
{
"status": "affected",
"version": "cdf62c535a9bfd5ff0eef4b91669da39d8abc0c3",
"versionType": "git"
},
{
"status": "affected",
"version": "5171ef20bae852ff38f4cfdb368bcdcc744776d0",
"versionType": "git"
},
{
"lessThan": "5.18",
"status": "affected",
"version": "5.17.15",
"versionType": "semver"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/nbd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.10.*",
"status": "unaffected",
"version": "6.10.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.113",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.54",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.10.13",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.2",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between timeout and normal completion\n\nIf request timetout is handled by nbd_requeue_cmd(), normal completion\nhas to be stopped for avoiding to complete this requeued request, other\nuse-after-free can be triggered.\n\nFix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime\nmake sure that cmd-\u003elock is grabbed for clearing the flag and the\nrequeue."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The race is driven by the NBD reply stream received over TCP in `recv_work()`/`nbd_handle_reply()`, code that processes data from a remote peer; a malicious or compromised NBD server \u2014 or an on-path attacker, since the NBD protocol is plaintext and unauthenticated on port 10809 \u2014 controls reply timing and content.\nAC:L - The remote server controls both sides of the race: it withholds a reply to force `nbd_xmit_timeout()` to fire, then delivers the reply at that instant to collide with `nbd_requeue_cmd()`, and it can repeat this across many in-flight requests indefinitely at no cost.\nPR:N - The NBD protocol carries no authentication, so the attacking server or MITM needs no credentials or privileges on the victim host; the CAP_SYS_ADMIN gate only covers the victim admin\u0027s own legitimate `nbd-client` setup, which is a pre-existing deployment condition rather than an attacker privilege.\nUI:N - No victim action is needed at attack time \u2014 an already-established NBD session (diskless boot, cloud block storage) is enough, and a compromised server or on-path attacker triggers the race unilaterally.\nS:U - The use-after-free and block-layer corruption stay within the kernel of the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Re-dispatching an already-completed request makes `nbd_send_cmd()` walk freed bio/bvec memory and transmit its contents over the socket to the attacker-controlled server, directly disclosing freed kernel/page-cache data.\nI:H - A re-dispatched READ writes the server\u0027s attacker-chosen reply payload into freed and possibly reallocated pages, and the requeue of a reused request corrupts `q-\u003erequeue_list`/`rq-\u003equeuelist` \u2014 a controlled write primitive usable for control-flow hijacking.\nA:H - The double completion and requeue of a freed/reused request reliably produce list corruption, KASAN use-after-free splats, oops, or hang of the storage path and the machine."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:40:05.597Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9c25faf72d780a9c71081710cd48759d61ff6e9b"
},
{
"url": "https://git.kernel.org/stable/c/6e73b946a379a1dfbb62626af93843bdfb53753d"
},
{
"url": "https://git.kernel.org/stable/c/5236ada8ebbd9e7461f17477357582f5be4f46f7"
},
{
"url": "https://git.kernel.org/stable/c/9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc"
},
{
"url": "https://git.kernel.org/stable/c/c9ea57c91f03bcad415e1a20113bdb2077bcf990"
}
],
"title": "nbd: fix race between timeout and normal completion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-49855",
"datePublished": "2024-10-21T12:18:47.391Z",
"dateReserved": "2024-10-21T12:17:06.016Z",
"dateUpdated": "2026-08-05T11:40:05.597Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.