Security readout for executives and security teams
Plain-English summary
A flaw in Linux nilfs2 filesystem handling can trigger a kernel failure after filesystem corruption is detected and the filesystem becomes read-only. Systems using affected kernels may suffer crashes or potentially broader security impact when interacting with a problematic nilfs2 filesystem.
Executive priority
Prioritize remediation on systems actively using nilfs2 or processing less-trusted filesystem content. Treat general Linux fleet exposure as conditional rather than universal. Coordinate normal kernel patching promptly; accelerate where a crash would disrupt critical services.
Technical view
nilfs2 failed to clear a page or folio “checked” flag during its discard process. After reload, directory-entry validation could be skipped, allowing an out-of-page access to reach a BUG_ON in __block_write_begin_int(). The record classifies this as CWE-787 with CVSS 7.8 and local, low-complexity, user-interaction-required conditions.
Likely exposure
Exposure is concentrated on affected Linux systems that mount or otherwise process nilfs2 filesystems. Risk is greater where users can introduce filesystem media or images. Systems not using nilfs2 are unlikely to expose the vulnerable path. The supplied version data is insufficient for precise package-level conclusions.
Exploitation context
The CVSS vector indicates local access and user interaction are required. The issue was discovered by syzbot and occurs following detected filesystem corruption. The supplied sources provide no evidence of active exploitation, and the CVE is not identified as CISA KEV.
Researcher notes
The vulnerable state transition involves nilfs2 detecting corruption, degrading read-only, discarding a page or folio without clearing its checked flag, and later skipping directory-entry validation after reload. Stable fixes are referenced across several kernel branches. Exact vulnerable and fixed package boundaries should be obtained from the relevant distributor.
Mitigation direction
- Install a vendor-supported kernel update containing the applicable stable nilfs2 fix.
- Consult the Linux distributor advisory for exact fixed package versions and reboot requirements.
- Limit nilfs2 use on affected systems until patched, where operationally feasible.
Validation and detection
- Inventory running kernel versions and distributor package revisions.
- Identify systems mounting nilfs2 filesystems or accepting user-supplied filesystem media or images.
- Confirm the installed kernel changelog or source contains the applicable stable fix.
- Review kernel logs for nilfs2 corruption, read-only degradation, or related kernel BUG events.
- After updating and rebooting, verify the corrected kernel is running.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50230 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/994b2fa13a6c9cf3feca93090a9c337d48e3d60dCVE reference, Linux
- https://git.kernel.org/stable/c/64afad73e4623308d8943645e5631f2c7a2d7971CVE reference, Linux
- https://git.kernel.org/stable/c/aa0cee46c5d3fd9a39575a4c8a4f65f25f095b89CVE reference, Linux
- https://git.kernel.org/stable/c/f05dbebb8ee34882505d53d83af7d18f28a49248CVE reference, Linux
- https://git.kernel.org/stable/c/cd0cdb51b15203fa27d4b714be83b7dfffa0b752CVE reference, Linux
- https://git.kernel.org/stable/c/f2f1fa446676c21edb777e6d2bc4fa8f956fab68CVE reference, Linux
- https://git.kernel.org/stable/c/56c6171932a7fb267ac6cb4ff8759b93ee1d0e2eCVE reference, Linux
- https://git.kernel.org/stable/c/41e192ad2779cae0102879612dfe46726e4396aaCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.