Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-50119: Linux kernel CIFS module may cause warning on shutdown

CVE-2024-50119 · published 1 year ago

Summary

The CIFS (network file sharing) component in the Linux kernel could trigger a warning message when its internal request pool is destroyed, potentially cluttering logs. This does not affect data safety but should be fixed to keep the system clean. Updating to a kernel version that includes the fix or applying the patch from the Linux source will resolve the issue.

What to do

Update debian linux to version 6.11.6-1.
Update linux kernel to version 6.11.6.
Update linux linux_kernel to version 6.11.6 or later.
Update linux linux to version 726416a253c51037636ecc65ad3dada3d02dcaea or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	linux	linux_kernel	>= 6.10, < 6.11.6 6.12 `cpe:2.3:o:linux:linux_kernel::::::::`
–	linux	linux	< 726416a253c51037636ecc65ad3dada3d02dcaea 6.10
Debian:13	debian	linux	< 6.11.6-1 Fix: upgrade to 6.11.6-1
Linux	linux	kernel	>= 6.10.0, < 6.11.6 Fix: upgrade to 6.11.6

Original advisory text

cifs: fix warning when destroy 'cifs_io_request_pool'

In the Linux kernel, the following vulnerability has been resolved: cifs: fix warning when destroy 'cifs_io_request_pool' There's a issue as follows: WARNING: CPU: 1 PID: 27826 at mm/slub.c:4698 free_large_kmalloc+0xac/0xe0 RIP: 0010:free_large_kmalloc+0xac/0xe0 Call Trace: <TASK> ? __warn+0xea/0x330 mempool_destroy+0x13f/0x1d0 init_cifs+0xa50/0xff0 [cifs] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Obviously, 'cifs_io_request_pool' is not created by mempool_create(). So just use mempool_exit() to revert 'cifs_io_request_pool'.

References

https://security-tracker.debian.org/tracker/CVE-2024-50119 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50119... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-50119 Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
https://git.kernel.org/stable/c/726416a253c51037636ecc65ad3dada3d02dcaea URL
https://git.kernel.org/stable/c/2ce1007f42b8a6a0814386cb056feb28dc6d6091 URL

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Timeline

Published5 Nov 2024

Updated2 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-50119 · NVD

CVE-2024-50119 · MITRE

DEBIAN-CVE-2024-50119 · OSV

CVE-2024-50119 · OSV

Track software like this

Free during beta