Security readout for executives and security teams
Plain-English summary
A timing flaw in the Linux Network Block Device subsystem can let a timed-out request also complete normally. This double handling may access freed memory, potentially crashing the kernel or corrupting data. The supplied record rates it critical, but does not establish a practical attack path.
Executive priority
Treat as urgent for infrastructure that uses NBD, particularly availability-sensitive or multi-tenant systems. Validate exposure before assuming the 9.8 network rating represents direct internet risk. Patch confirmed affected systems through supported distribution channels and track completion through the required kernel activation or reboot.
Technical view
A race exists between nbd_requeue_cmd() and normal request completion. When a timeout requeues a request without stopping its normal completion path, the request can be completed after requeueing and trigger a use-after-free. The stable fix clears NBD_CMD_INFLIGHT while holding cmd->lock during flag clearing and requeueing.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel and actively using the Network Block Device subsystem. The supplied version data identifies several affected kernel lines but is complex and includes commit identifiers; confirm applicability against each distribution's kernel package and vendor advisory.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public exploit. Its CVSS 3.1 score is 9.8, but the sources do not demonstrate the required access path or practical confidentiality, integrity, and availability impact. Absence from KEV does not prove exploitation is absent.
Researcher notes
The security consequence described by the kernel source is a race-triggered use-after-free. The bundle does not provide reproduction details, exploitability evidence, affected configurations, or proof of remote reachability. Researchers should distinguish upstream kernel versions from distribution backports and verify whether NBD is configured and exercised before rating environmental risk.
Mitigation direction
- Install a vendor-supported kernel package containing the applicable stable fix.
- Prioritize systems actively using Linux Network Block Device functionality.
- Review Linux distribution advisories to identify fixed package versions.
- Follow vendor guidance for activating the updated kernel, including any required reboot.
Validation and detection
- Inventory kernel versions and identify hosts using the Network Block Device subsystem.
- Compare each kernel package against its distribution's affected and fixed version guidance.
- Confirm the running kernel after remediation matches the installed fixed package.
- Review relevant kernel and service logs for timeout, requeue, crash, or memory-corruption symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49855 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9c25faf72d780a9c71081710cd48759d61ff6e9bCVE reference, Linux
- https://git.kernel.org/stable/c/6e73b946a379a1dfbb62626af93843bdfb53753dCVE reference, Linux
- https://git.kernel.org/stable/c/5236ada8ebbd9e7461f17477357582f5be4f46f7CVE reference, Linux
- https://git.kernel.org/stable/c/9a74c3e6c0d686c26ba2aab66d15ddb89dc139ccCVE reference, Linux
- https://git.kernel.org/stable/c/c9ea57c91f03bcad415e1a20113bdb2077bcf990CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.