{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-50119","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-10-21T19:36:19.948Z","datePublished":"2024-11-05T17:10:49.261Z","dateUpdated":"2026-08-05T11:41:47.758Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:41:47.758Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix warning when destroy 'cifs_io_request_pool'\n\nThere's a issue as follows:\nWARNING: CPU: 1 PID: 27826 at mm/slub.c:4698 free_large_kmalloc+0xac/0xe0\nRIP: 0010:free_large_kmalloc+0xac/0xe0\nCall Trace:\n <TASK>\n ? __warn+0xea/0x330\n mempool_destroy+0x13f/0x1d0\n init_cifs+0xa50/0xff0 [cifs]\n do_one_initcall+0xdc/0x550\n do_init_module+0x22d/0x6b0\n load_module+0x4e96/0x5ff0\n init_module_from_file+0xcd/0x130\n idempotent_init_module+0x330/0x620\n __x64_sys_finit_module+0xb3/0x110\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nObviously, 'cifs_io_request_pool' is not created by mempool_create().\nSo just use mempool_exit() to revert 'cifs_io_request_pool'."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code runs only during cifs module initialization, reached via a local `finit_module()` or via local filesystem-autoload triggered by a `mount -t cifs` / `fsopen(\"cifs\")` syscall. No remote peer data is involved.\nAC:H - The buggy `mempool_destroy()` is only reached when `kmem_cache_create(\"cifs_io_subrequest\")` or the subrequest mempool init fails while the preceding cifs_io_request allocations succeeded; the attacker can create memory/percpu pressure and retry the autoload repeatedly, but cannot force that specific one-shot init allocation to fail at will.\nPR:L - `__request_module()` contains no capability check, and `do_new_mount()` calls `get_fs_type()` (triggering `request_module(\"fs-cifs\")`) before any `FS_USERNS_MOUNT` check, gated only by `may_mount()` = `ns_capable(CAP_SYS_ADMIN)` — satisfiable by an unprivileged user via `unshare -Urm`, so no real root is needed.\nUI:N - The attacker drives the module load and the memory-pressure conditions entirely from their own process; no action by any other user is required.\nS:U - The corruption is confined to kernel memory managed by the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - `folio_put()` on the bogus folio can drop an unrelated live page's refcount to zero, returning a still-in-use page to the allocator; reallocation of that page exposes its residual contents, giving an arbitrary-read-class disclosure primitive.\nI:H - The stray `folio_put()` and `lruvec_stat_mod_folio()` corrupt refcounts and accounting of memory the kernel never allocated here; a page freed while still mapped is a page-level use-after-free, the classic basis for page-table spraying and privilege escalation.\nA:H - The path unconditionally hits `WARN_ON_ONCE` in `free_large_kmalloc()` (a panic on `panic_on_warn` systems), and the resulting page-refcount corruption leads to oopses or a panic once the wrongly-freed page is reused."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cifsfs.c"],"versions":[{"version":"edea94a69730b74a8867bbafe742c3fc4e580722","lessThan":"726416a253c51037636ecc65ad3dada3d02dcaea","status":"affected","versionType":"git"},{"version":"edea94a69730b74a8867bbafe742c3fc4e580722","lessThan":"2ce1007f42b8a6a0814386cb056feb28dc6d6091","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/cifsfs.c"],"versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","status":"unaffected","versionType":"semver"},{"version":"6.11.6","lessThanOrEqual":"6.11.*","status":"unaffected","versionType":"semver"},{"version":"6.12","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.11.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/726416a253c51037636ecc65ad3dada3d02dcaea"},{"url":"https://git.kernel.org/stable/c/2ce1007f42b8a6a0814386cb056feb28dc6d6091"}],"title":"cifs: fix warning when destroy 'cifs_io_request_pool'","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-50119","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-10-01T20:21:43.395219Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","description":"CWE-noinfo Not enough information"}]}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-10-01T20:27:16.497Z"}}]}}