7.8

CVE-2024-49966: debian debian_linux Use After Free

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2024-49966DEBIAN-CVE-2024-49966
Published 21-10-2024Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2024-49966 is a high (CVSS 7.8) Use After Free vulnerability in debian debian_linux. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.8% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.27%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 50 · Related 48
DLA-4008-1DLA-4075-1MGASA-2024-0344MGASA-2024-0345OPENSUSE-SU-2024:14500-1OPENSUSE-SU-2025:14705-1

Timeline

  1. 21-10-2024
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2_global_read_info() will initialize and schedule dqi_sync_work at the end, if error occurs after successfully reading global quota, it will trigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled: ODEBUG: free active (active state 0) object: 00000000d8b0ce28 object type: timer_list hint: qsync_work_fn+0x0/0x16c This reports that there is an active delayed work when freeing oinfo in error handling, so cancel dqi_sync_work first. BTW, return status instead of -1 when .read_file_info fails.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.27%

Chance of exploitation in the next 30 days

Percentile

18%

Versus all other CVEs

30-day change

0.00 pp

From 0.27% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.27%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu134 products
  • linuxAll versions (No fix recorded) | < 5.4.0-208.228 | < 5.15.0-127.137 | < 6.8.0-54.56
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.4.0-1140.150 | < 5.15.0-1073.79 | < 6.8.0-1023.25
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ 171bf93ce11f4c9929fdce6ce63df8da2f3c4475, < fc5cc716dfbdc5fd5f373ff3b51358174cf88bfc | ≥ 171bf93ce11f4c9929fdce6ce63df8da2f3c4475, < 89043e7ed63c7fc141e68ea5a79758ed24b6c699 | ≥ 171bf93ce11f4c9929fdce6ce63df8da2f3c4475, < 14114d8148db07e7946fb06b56a50cfa425e26c7 | ≥ 171bf93ce11f4c9929fdce6ce63df8da2f3c4475, < 4173d1277c00baeedaaca76783e98b8fd0e3c08d | ≥ 171bf93ce11f4c9929fdce6ce63df8da2f3c4475, < bbf41277df8b33fbedf4750a9300c147e8f104eb | ≥ 171bf93ce11f4c9929fdce6ce63df8da2f3c4475, < ef768020366f47d23f39c4f57bcb03af6d1e24b3 | ≥ 171bf93ce11f4c9929fdce6ce63df8da2f3c4475, < a4346c04d055bf7e184c18a73dbd23b6a9811118 | ≥ 171bf93ce11f4c9929fdce6ce63df8da2f3c4475, < 0d707a33c84b371cb66120e198eed3374726ddd8 | ≥ 171bf93ce11f4c9929fdce6ce63df8da2f3c4475, < 35fccce29feb3706f649726d410122dd81b92c18 | 2.6.29
  • linux_kernel≥ 2.6.29, < 4.19.323 | ≥ 4.20, < 5.4.285 | ≥ 5.5, < 5.10.227 | ≥ 5.11, < 5.15.168 | ≥ 5.16, < 6.1.113 | ≥ 6.2, < 6.6.55 | ≥ 6.7, < 6.10.14 | ≥ 6.11, < 6.11.3

3 vendors · 138 products

References

48 links
Show all 48 references