Security readout for executives and security teams
Plain-English summary
A Linux NFS server can emit a kernel warning when an ext4 directory checksum error reaches NFS as an unexpected error code. The correction converts that condition into a standard NFS input/output error. The supplied record rates availability impact high, but it does not establish data theft, modification, or active exploitation.
Executive priority
Use expedited, risk-based remediation for affected production NFS servers, particularly critical or broadly reachable systems. This is a high-scored availability issue, but the sources do not support declaring an exploitation emergency. Pair kernel remediation with investigation of any ext4 checksum errors, which may signal an underlying integrity or storage problem.
Technical view
During NFS directory enumeration, ext4_readdir may return EBADMSG after directory-block checksum verification fails. nfserrno did not recognize that errno and generated a kernel warning. Stable-kernel fixes map EBADMSG to nfserr_io. The bundle assigns CVSS 3.1 score 7.5 for network-reachable availability impact, although the evidence does not explain how a remote client could induce the checksum failure.
Likely exposure
Potential exposure is limited to affected Linux kernels operating NFS server functionality where an exported ext4 directory reaches the checksum-error path. Systems without NFS serving, without ext4-backed exports, or with vendor-backported fixes are less likely to be exposed. Confirm distribution package status because upstream version strings alone may be misleading.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation, public exploit code, or a demonstrated remote trigger. It documents a warning caused by error translation after an ext4 checksum failure. Treat the network CVSS vector as recorded severity, not proof that attackers can remotely create the underlying filesystem condition.
Researcher notes
The central defect is incomplete errno translation in nfserrno, not the ext4 checksum failure itself. The patch maps EBADMSG to nfserr_io across stable branches. The bundle does not identify a CWE, reproducible remote attack, crash consequence, or attacker-controlled path to checksum corruption. Availability severity should therefore be interpreted cautiously until vendor or upstream evidence clarifies practical reachability.
Mitigation direction
- Apply a vendor-supported kernel containing the CVE fix or an equivalent backport.
- Prioritize internet-accessible or business-critical NFS servers using ext4-backed exports.
- Restrict NFS exposure to required clients and trusted networks while remediation is pending.
- Check Linux distribution advisories for package-specific fixed versions before upgrading.
- Investigate ext4 checksum errors because they may indicate filesystem or storage integrity problems.
Validation and detection
- Inventory kernel versions, active NFS server instances, and filesystems backing exported directories.
- Confirm whether the installed distribution kernel includes one of the referenced stable fixes.
- Review kernel logs for "nfsd: non-standard errno: -74" and ext4 checksum warnings.
- After updating, verify the running kernel version and repeat normal NFS directory operations.
- Confirm storage and filesystem health if checksum failures appear in logs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49875 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0ea4333c679f333e23956de743ad17387819d3f2CVE reference, Linux
- https://git.kernel.org/stable/c/825789ca94602543101045ad3aad19b2b60c6b2aCVE reference, Linux
- https://git.kernel.org/stable/c/6fe058502f8864649c3d614b06b2235223798f48CVE reference, Linux
- https://git.kernel.org/stable/c/f7d8ee9db94372b8235f5f22bb24381891594c42CVE reference, Linux
- https://git.kernel.org/stable/c/c76005adfa93d1a027433331252422078750321fCVE reference, Linux
- https://git.kernel.org/stable/c/e9cfecca22a36b927a440abc6307efb9e138fed5CVE reference, Linux
- https://git.kernel.org/stable/c/340e61e44c1d2a15c42ec72ade9195ad525fd048CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.