LiveActive security incident?Get immediate response
CVE Record

CVE-2024-49889: ext4: avoid use-after-free in ext4_ext_show_leaf()

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid use-after-free in ext4_ext_show_leaf() In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows: ext4_split_extent path = *ppath; ext4_split_extent_at(ppath) path = ext4_find_extent(ppath) ext4_split_extent_at(ppath) // ext4_find_extent fails to free path // but zeroout succeeds ext4_ext_show_leaf(inode, path) eh = path[depth].p_hdr // path use-after-free !!! Similar to ext4_split_extent_at(), we use *ppath directly as an input to ext4_ext_show_leaf(). Fix a spelling error by the way. Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly. This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Linux ext4 debug code can reuse freed memory while displaying extent information after an error. A local, low-privileged user is the modeled attacker, but the kernel record says the flaw is reachable only when EXT_DEBUG is compiled and does not affect normal functionality. Production exposure is therefore likely limited despite the 7.8 CVSS score.

Executive priority

Treat this as targeted kernel maintenance rather than an emergency fleet-wide incident. Promptly identify EXT_DEBUG systems, especially shared or locally accessible hosts, and patch those first. Maintain normal vendor-led kernel updates elsewhere. Escalate only if configuration checks confirm exposure or new exploitation evidence emerges.

Technical view

ext4_find_extent() can free or reallocate an extent path, leaving a saved pointer stale. ext4_ext_show_leaf() may then dereference it in ext4_split_extent() and ext4_ext_handle_unwritten_extents(). The fix passes the current *ppath directly and removes the stale local path. Triggering requires an EXT_DEBUG build.

Likely exposure

The bundle lists Linux kernel versions and stable commits but does not clearly map every vulnerable-to-fixed range. Practical exposure is limited to kernels built with EXT_DEBUG. Hosts permitting local low-privileged access provide the attacker position represented by the CVSS vector. Other builds should not be assumed exposed without configuration verification.

Exploitation context

The CVE is not listed in KEV, and the supplied sources provide no evidence of active exploitation or public weaponization. The CVSS vector models local, low-complexity exploitation by a low-privileged user without interaction. Its high theoretical impact is constrained by the debug-only trigger condition.

Researcher notes

The stale path arises when extent lookup frees or reallocates memory before diagnostic leaf display. The correction consistently uses *ppath after operations that may change it. Source evidence explicitly limits triggering to EXT_DEBUG and says functionality is unaffected. Exact affected and fixed package boundaries remain distribution-specific and incomplete in the bundle.

Mitigation direction

  • Apply the vendor or Linux stable kernel update containing the listed fix for the maintained branch.
  • Prioritize systems whose kernel configuration defines EXT_DEBUG and that permit untrusted local users.
  • If immediate updating is unavailable, use a vendor-supported kernel build without EXT_DEBUG.
  • Review applicable vendor advisories because the bundle does not provide a universal fixed-version mapping.

Validation and detection

  • Record each host's running kernel release, distribution package version, and booted kernel build.
  • Inspect the kernel build configuration for EXT_DEBUG; its absence materially reduces practical exposure.
  • Match the running package or commit against the applicable vendor advisory or listed stable fix.
  • After updating, reboot if required and verify the fixed kernel is currently running.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-49889 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
12Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-49889Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdfe5080939ea4686b3414b5d970a9b26733c57a4, dfe5080939ea4686b3414b5d970a9b26733c57a4, dfe5080939ea4686b3414b5d970a9b26733c57a4, dfe5080939ea4686b3414b5d970a9b26733c57a4, dfe5080939ea4686b3414b5d970a9b26733c57a4, dfe5080939ea4686b3414b5d970a9b26733c57a4, dfe5080939ea4686b3414b5d970a9b26733c57a4unaffected
LinuxLinux3.18, 0, 5.10.227, 5.15.168, 6.1.113, 6.6.55, 6.10.14, 6.11.3, 6.12affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.