01 Record

CVE-2024-49960

ext4: fix timer use-after-free on failed mount

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

View raw JSON

02 Description

ext4: fix timer use-after-free on failed mount

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.29% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 21.3% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-08-04.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-10-21 18:02Z1 YR AGO

Last updated

2026-08-05 11:40Z1 MO AGO

Reserved

2024-10-21

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.2

Document digest

0657a0c2b65ea57240b831ba335fdb3240484a38407bb72c5a9c9a230ed412cb

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux5e4f5138bd8522ebe231a137682d3857209a2c07 to < 7aac0c17a8cdf4a3236991c1e60435c6a984076c, 618f003199c6188e01472b03cdbba227f1dc5f24 to < 22e9b83f0f33bc5a7a3181769d1dccbf021f5b04, 618f003199c6188e01472b03cdbba227f1dc5f24 to < cf3196e5e2f36cd80dab91ffae402e13935724bc, 618f003199c6188e01472b03cdbba227f1dc5f24 to < 9203817ba46ebba7c865c8de2aba399537b6e891, 618f003199c6188e01472b03cdbba227f1dc5f24 to < fa78fb51d396f4f2f80f8e96a3b1516f394258be, 618f003199c6188e01472b03cdbba227f1dc5f24 to < b85569585d0154d4db1e4f9e3e6a4731d407feb0, 618f003199c6188e01472b03cdbba227f1dc5f24 to < 0ce160c5bdb67081a62293028dc85758a8efb22a, cecfdb9cf9a700d1037066173abac0617f6788df, eb7b40d9d3785f7a131fb0b1f89bb6efa46c1833, 5.10.51 to < 5.10.237, 5.12.18 to < 5.13, 5.13.3 to < 5.14, 5.14—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/7aac0c17a8cdf4a3236991c1e60435c6a984076c
git.kernel.orghttps://git.kernel.org/stable/c/22e9b83f0f33bc5a7a3181769d1dccbf021f5b04
git.kernel.orghttps://git.kernel.org/stable/c/cf3196e5e2f36cd80dab91ffae402e13935724bc
git.kernel.orghttps://git.kernel.org/stable/c/9203817ba46ebba7c865c8de2aba399537b6e891
git.kernel.orghttps://git.kernel.org/stable/c/fa78fb51d396f4f2f80f8e96a3b1516f394258be
git.kernel.orghttps://git.kernel.org/stable/c/b85569585d0154d4db1e4f9e3e6a4731d407feb0
git.kernel.orghttps://git.kernel.org/stable/c/0ce160c5bdb67081a62293028dc85758a8efb22a
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

01 Record index

CVE-2024-49960

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2024-49960

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References