01 Record

CVE-2024-41049

filelock: fix potential use-after-free in posix_lock_inode

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

filelock: fix potential use-after-free in posix_lock_inode

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.28% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 20.3% of scored records. A rank, not a probability.

NVD base score

7.0 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-08-04.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-07-29 14:32Z2 YR AGO

Last updated

2026-08-05 11:35Z2 MO AGO

Reserved

2024-07-12

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.2

Document digest

470becfe1ce5a5a8e4b16abfb2c34e1c94ce4726a65a03874bebd6ad553e87c4

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux117fb80cd1e63c419c7a221ce070becb4bfc7b6d to < 1cbbb3d9475c403ebedc327490c7c2b991398197, a6f4129378ca15f62cbdde09a7d3ccc35adcf49d to < 7d4c14f4b511fd4c0dc788084ae59b4656ace58b, 766e56faddbec2eaf70c9299e1c9ef74d846d32b to < 02a8964260756c70b20393ad4006948510ac9967, 34bff6d850019e00001129d6de3aa4874c2cf471 to < 5cb36e35bc10ea334810937990c2b9023dacb1b0, 74f6f5912693ce454384eaeec48705646a21c74f to < 432b06b69d1d354a171f7499141116536579eb6a, 74f6f5912693ce454384eaeec48705646a21c74f to < 116599f6a26906cf33f67975c59f0692ecf7e9b2, 74f6f5912693ce454384eaeec48705646a21c74f to < 1b3ec4f7c03d4b07bad70697d7e2f4088d2cfe92, e75396988bb9b3b90e6e8690604d0f566cea403a, 5.4.257 to < 5.4.280, 5.10.197 to < 5.10.222, 5.15.133 to < 5.15.163, 6.1.55 to < 6.1.100, 6.5.5 to < 6.6, 6.6—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/1cbbb3d9475c403ebedc327490c7c2b991398197
git.kernel.orghttps://git.kernel.org/stable/c/7d4c14f4b511fd4c0dc788084ae59b4656ace58b
git.kernel.orghttps://git.kernel.org/stable/c/02a8964260756c70b20393ad4006948510ac9967
git.kernel.orghttps://git.kernel.org/stable/c/5cb36e35bc10ea334810937990c2b9023dacb1b0
git.kernel.orghttps://git.kernel.org/stable/c/432b06b69d1d354a171f7499141116536579eb6a
git.kernel.orghttps://git.kernel.org/stable/c/116599f6a26906cf33f67975c59f0692ecf7e9b2
git.kernel.orghttps://git.kernel.org/stable/c/1b3ec4f7c03d4b07bad70697d7e2f4088d2cfe92
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.106-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.9.10-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.9.10-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.