Security readout for executives and security teams
Plain-English summary
CVE-2024-49965 is a Linux kernel locking error in the OCFS2 filesystem’s block-reading path. The supplied CVSS assessment indicates that a local, low-privileged attacker could potentially affect confidentiality, integrity, and availability. Systems not using affected kernels or OCFS2 are less likely to be exposed.
Executive priority
Treat this as a high-priority kernel maintenance issue on systems using OCFS2, especially sensitive or shared-storage hosts. It is not supported as an emergency internet-wide threat because access is local and active exploitation is not reported. Establish exposure promptly, then apply supported kernel updates through normal expedited change control.
Technical view
The flaw is an incorrect lock release in ocfs2_read_blocks(). A lock had already been released before the function exited, creating an unlock imbalance. The kernel fix removes the extra unlock. The sources do not establish the precise crash, corruption, or privilege-escalation mechanism, so those outcomes should not be asserted individually.
Likely exposure
Exposure is most likely on systems running a listed affected Linux kernel where OCFS2 is present and its block-reading path is reachable. The bundle lists affected releases from 4.20 through several maintained branches and 6.12, but vendor backports may alter status. Confirm exact packaged kernels with the distributor.
Exploitation context
The CVSS vector describes local access, low complexity, low privileges, and no user interaction. The supplied KEV status is false, and no cited source reports active exploitation. The issue was found through syzbot lock-balance detection and subsequent review, indicating evidence of a defect but not confirmed malicious use.
Researcher notes
The record identifies an extra unlock in ocfs2_read_blocks() and supplies fixes across stable branches. Its affected-version data mixes release numbers and commit identifiers, limiting reliable range interpretation without vendor packaging context. No CWE is assigned. Researchers should distinguish the demonstrated lock imbalance from unproven outcomes such as privilege escalation or data corruption.
Mitigation direction
- Install the distributor-supported kernel update containing the applicable stable fix.
- Check vendor advisories for backported fixes before judging exposure by version number alone.
- Prioritize shared-storage or sensitive systems that actively use OCFS2.
- If immediate updating is impossible, consult vendor guidance for supported temporary risk reduction.
Validation and detection
- Inventory kernel versions and identify systems configured to use OCFS2.
- Compare each packaged kernel against its distributor’s CVE or security advisory.
- Verify the installed kernel contains the applicable stable fix or documented backport.
- After updating, confirm systems booted into the remediated kernel.
- Review kernel logs for OCFS2 locking warnings or related instability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49965 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5245f109b4afb6595360d4c180d483a6d2009a59CVE reference, Linux
- https://git.kernel.org/stable/c/9753bcb17b36c9add9b32c61766ddf8d2d161911CVE reference, Linux
- https://git.kernel.org/stable/c/3f1ca6ba5452d53c598a45d21267a2c0c221eef3CVE reference, Linux
- https://git.kernel.org/stable/c/f55a33fe0fb5274ef185fd61947cf142138958afCVE reference, Linux
- https://git.kernel.org/stable/c/81aba693b129e82e11bb54f569504d943d018de9CVE reference, Linux
- https://git.kernel.org/stable/c/84543da867c967edffd5065fa910ebf56aaae49dCVE reference, Linux
- https://git.kernel.org/stable/c/df4f20fc3673cee11abf2c571987a95733cb638dCVE reference, Linux
- https://git.kernel.org/stable/c/39a88623af3f1c686bf6db1e677ed865ffe6fcccCVE reference, Linux
- https://git.kernel.org/stable/c/c03a82b4a0c935774afa01fd6d128b444fd930a1CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.