Security readout for executives and security teams
Plain-English summary
A failed ext4 filesystem mount can leave an error-reporting timer running after its supporting kernel memory is freed. Later timer activity could corrupt memory, crash the system, or potentially affect confidentiality and integrity. Triggering requires local interaction with a problematic ext4 mount; this is not described as a remote network vulnerability.
Executive priority
Treat this as prompt kernel-maintenance work, prioritizing infrastructure exposed to untrusted or unreliable ext4 media. It does not currently justify an internet-wide emergency response because triggering is local and active exploitation is not evidenced. Delays remain undesirable because kernel memory corruption can have severe consequences.
Technical view
During ext4_fill_super failure handling, ext4_stop_mmpd can encounter a read I/O failure and invoke ext4_handle_error, which re-arms s_err_report. The filesystem state is then freed while the timer remains active, creating a use-after-free. The upstream correction cancels the timer after ext4_stop_mmpd.
Likely exposure
Exposure is most plausible on affected Linux systems that mount corrupted, unreliable, removable, user-supplied, or virtual ext4 filesystems. The supplied version records are complex and should not be treated as simple inclusive ranges. Confirm exposure against the running distribution kernel and vendor backport status.
Exploitation context
The CVSS 3.1 score is 7.8 with local access, low complexity, no privileges, and user interaction. The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. Syzbot discovered the defect through automated kernel testing.
Researcher notes
The failure sequence is important: an earlier timer cancellation is insufficient because the read-error path can re-arm the timer before filesystem state is freed. The source bundle identifies upstream stable fixes but does not establish practical exploitability, exploitation in the wild, or a definitive distribution-neutral affected-version range.
Mitigation direction
- Apply a distribution kernel update incorporating the referenced upstream fix, following vendor reboot guidance.
- Until updated, restrict untrusted ext4 mounting and automated mount paths where operationally feasible.
- Check Linux distribution advisories for backported fixes rather than relying only on upstream version numbers.
Validation and detection
- Inventory running kernel and package versions on systems that use or mount ext4 filesystems.
- Compare each kernel build with distribution advisories and the referenced upstream stable commits.
- Prioritize review of systems handling removable media, virtual disk images, or user-controlled filesystems.
- After updating and rebooting, confirm the patched kernel is running across the affected fleet.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49960 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7aac0c17a8cdf4a3236991c1e60435c6a984076cCVE reference, Linux
- https://git.kernel.org/stable/c/22e9b83f0f33bc5a7a3181769d1dccbf021f5b04CVE reference, Linux
- https://git.kernel.org/stable/c/cf3196e5e2f36cd80dab91ffae402e13935724bcCVE reference, Linux
- https://git.kernel.org/stable/c/9203817ba46ebba7c865c8de2aba399537b6e891CVE reference, Linux
- https://git.kernel.org/stable/c/fa78fb51d396f4f2f80f8e96a3b1516f394258beCVE reference, Linux
- https://git.kernel.org/stable/c/b85569585d0154d4db1e4f9e3e6a4731d407feb0CVE reference, Linux
- https://git.kernel.org/stable/c/0ce160c5bdb67081a62293028dc85758a8efb22aCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.