7.5

CVE-2024-50241: NFSD: Initialize struct nfsd4_copy earlier

Modified
AliasesUBUNTU-CVE-2024-50241DEBIAN-CVE-2024-50241
Published 09-11-2024Last modified 05-08-2026

Vulnerability summary

CVE-2024-50241 is a high (CVSS 7.5) Use of Uninitialized Resource vulnerability in linux. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 41.1% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 05-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.47%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
OPENSUSE-SU-2024:14500-1OPENSUSE-SU-2025:14705-1SUSE-SU-2026:5091-1

Timeline

  1. 09-11-2024
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Initialize struct nfsd4_copy earlier Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are not correctly initialized, at the very least, a refcount underflow occurs.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.47%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.47% on 06-10-2026

06-10-202605-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu76 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
  • linux-aws-5.13All versions (No fix recorded)
Linux2 products
  • linux≥ 9e52ff544e0bfa09ee339fd7b0937ee3c080c24e, < 059434d23c4578d9d02efb92d848ea21bc640112 | ≥ 43e46ee5efc03990b223f7aa8b77aa9c3d3acfdf, < 7267625baf365a969f1b25ded6f07b64bc90ec5b | ≥ 7ea9260874b779637aff6d24c344b8ef4ac862a0, < c3074003fa6837c2b89a34d8d12d9463b59d22d6 | ≥ ae267989b7b7933dfedcd26468d0a88fc3a9da9e, < 421f1a2a1afb47d88de09457ef7687e1df7bc997 | ≥ 6a488ad7745b8f64625c6d3a24ce7e448e83f11b, < e30a9a2f69c34a00a3cb4fd45c5d231929e66fb1 | ≥ aadc3bbea163b6caaaebfdd2b6c4667fbc726752, < 63fab04cbd0f96191b6e5beedc3b643b01c15889 | b4e21431a0db4854b5023cd5af001be557e6c3db | ≥ 6.10.14, < 6.11 | ≥ 6.11.3, < 6.11.7
  • linux_kernel≥ 6.10.14, < 6.11.7 | 6.12:rc1 | 6.12:rc2 | 6.12:rc3 | 6.12:rc4 | 6.12:rc5
Debian1 product
  • linux< 6.11.7-1

3 vendors · 79 products

References

10 links