Security readout for executives and security teams
Plain-English summary
A Linux NILFS2 filesystem recovery flaw can leave recovered inode objects improperly tracked after a mount-time error, causing a use-after-free. A successful trigger could compromise confidentiality, integrity, and availability. Exposure is limited to systems using affected Linux kernels with NILFS2 recovery conditions; this is not described as remotely exploitable.
Executive priority
Treat as a high-priority kernel maintenance issue on NILFS2-using systems, especially multi-user or untrusted-workload hosts. Patch through normal expedited maintenance. Broader emergency action is not supported by the supplied evidence because exploitation is local, active attacks are unconfirmed, and exposure depends on NILFS2 recovery.
Technical view
During NILFS2 roll-forward recovery of partial logs created by dsync writes, an error before the recovered-checkpoint log writer starts can leave recovered inodes on ns_dirty_files. Subsequent cleanup may access freed memory. KASAN identified the flaw through error injection. The correction cleans those inodes when recovery fails midway.
Likely exposure
Prioritize Linux systems that mount or may process NILFS2 filesystems on affected kernel versions. The supplied record lists versions from 2.6.30 through several stable-series releases, but distribution backports complicate version-only assessment. Systems without NILFS2 usage have substantially lower practical exposure.
Exploitation context
CVSS 3.1 scores this 7.8 with local access, low complexity, low privileges, no user interaction, and high potential impact. The supplied sources do not establish active exploitation, and the CVE is not listed as KEV. Practical triggering requirements beyond the documented recovery-error path remain incomplete.
Researcher notes
The issue was reproduced with KASAN error injection, establishing a genuine use-after-free but not public exploitation. Assessment should focus on reachability of the pre-log-writer recovery failure and distribution backport status. The supplied affected-version data contains duplicated commit entries and should not replace vendor package guidance.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable NILFS2 correction.
- Consult distribution advisories because patched kernels may retain older version numbers through backports.
- Where operationally feasible, avoid mounting untrusted or unnecessary NILFS2 filesystems until patched.
- Restrict local access and filesystem-mount privileges as defense in depth.
Validation and detection
- Inventory kernel builds and compare them with vendor-specific fixed package versions.
- Identify hosts loading NILFS2 or configured to mount NILFS2 filesystems.
- Confirm the installed kernel includes the relevant upstream stable fix or distribution backport.
- Review kernel logs for NILFS2 recovery failures or memory-safety diagnostics.
- Reboot into the updated kernel and verify the running version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-46781 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/35a9a7a7d94662146396199b0cfd95f9517cdd14CVE reference, Linux
- https://git.kernel.org/stable/c/da02f9eb333333b2e4f25d2a14967cff785ac82eCVE reference, Linux
- https://git.kernel.org/stable/c/07e4dc2fe000ab008bcfe90be4324ef56b5b4355CVE reference, Linux
- https://git.kernel.org/stable/c/8e2d1e9d93c4ec51354229361ac3373058529ec4CVE reference, Linux
- https://git.kernel.org/stable/c/ca92c4bff2833cb30d493b935168d6cccd5c805dCVE reference, Linux
- https://git.kernel.org/stable/c/9d8c3a585d564d776ee60d4aabec59b404be7403CVE reference, Linux
- https://git.kernel.org/stable/c/1cf1f7e8cd47244fa947d357ef1f642d91e219a3CVE reference, Linux
- https://git.kernel.org/stable/c/5787fcaab9eb5930f5378d6a1dd03d916d146622CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.