Security readout for executives and security teams
Plain-English summary
A flaw in Linux's OCFS2 filesystem can corrupt filesystem metadata and trigger a crash during certain reflink operations involving inline extended attributes. The supplied report describes an actual customer corruption incident. Affected OCFS2 systems could suffer data integrity and availability impacts, but the evidence does not establish malicious exploitation.
Executive priority
Treat this as a high-priority integrity and availability issue wherever OCFS2 is actively used, particularly for critical or shared storage. Patch during the nearest controlled maintenance window and accelerate action if corruption indicators appear. Deprioritize only after confirming OCFS2 is absent or the correction is present.
Technical view
OCFS2 reserved 256 bytes for inline extended attributes after recreating the destination reflink extent tree. This reduced the root metadata capacity from 243 to 227 records even when higher records already existed, leaving an invalid next-free value and causing corruption detection and a crash. The fix reserves space before rebuilding the reflink tree.
Likely exposure
Exposure is limited to systems using affected Linux kernels with OCFS2 and relevant reflink workflows involving inline extended attributes. Systems not using OCFS2 are unlikely to be affected. The supplied CVSS vector describes local, low-privilege access with no user interaction; remote exposure is not established.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no source reports active malicious exploitation or a public exploit. A customer experienced a crash and filesystem corruption, demonstrating operational impact rather than confirmed attack activity. The exact reliability and attacker control of the trigger remain unclear.
Researcher notes
The supplied record assigns CVSS 3.1 score 7.8 with local access, low complexity, low privileges, and high confidentiality, integrity, and availability impacts. No CWE is provided. The customer reportedly verified the ordering fix, but the bundle does not establish exploitability, reproducibility across configurations, or precise distribution package status.
Mitigation direction
- Apply a vendor-supported kernel update containing the applicable stable backport.
- Prioritize actively mounted OCFS2 filesystems and systems performing reflink operations.
- Follow Linux or distribution guidance when selecting the corrected kernel package.
- Protect critical data with verified backups before filesystem maintenance or recovery.
Validation and detection
- Inventory hosts that mount, manage, or store OCFS2 filesystems.
- Compare installed kernels with vendor advisories and applicable stable fix commits.
- Review storage and kernel logs for OCFS2 corruption detection or related crashes.
- Assess suspected volumes using supported OCFS2 consistency tooling and established recovery procedures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49958 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5c9807c523b4fca81d3e8e864dabc8c806402121CVE reference, Linux
- https://git.kernel.org/stable/c/74364cb578dcc0b6c9109519d19cbe5a56afac9aCVE reference, Linux
- https://git.kernel.org/stable/c/aac31d654a0a31cb0d2fa36ae694f4e164a52707CVE reference, Linux
- https://git.kernel.org/stable/c/020f5c53c17f66c0a8f2d37dad27ace301b8d8a1CVE reference, Linux
- https://git.kernel.org/stable/c/5c2072f02c0d75802ec28ec703b7d43a0dd008b5CVE reference, Linux
- https://git.kernel.org/stable/c/637c00e06564a945e9d0edb3d78d362d64935f9fCVE reference, Linux
- https://git.kernel.org/stable/c/9f9a8f3ac65b4147f1a7b6c05fad5192c0e3c3d9CVE reference, Linux
- https://git.kernel.org/stable/c/96ce4c3537114d1698be635f5e36c62dc49df7a4CVE reference, Linux
- https://git.kernel.org/stable/c/5ca60b86f57a4d9648f68418a725b3a7de2816b0CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.