CVE-2024-0841

HighCVSS 7.8/10Last modified Nov 5, 2026

Description

A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 9	—

References

https://access.redhat.com/errata/RHSA-2024:2394Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2950Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:3138Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-0841Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2256490Issue Tracking
https://access.redhat.com/errata/RHSA-2024:2394Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2950Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:3138Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-0841Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2256490Issue Tracking
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

Timeline

Published: Jan 28, 2024
Last modified: Nov 5, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-08427.5The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and includi CVE-2024-08447.2The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via th CVE-2024-08455.4The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to CVE-2024-08474.3The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,CVE-2024-08486.1The AA Cash Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘invoice’ parameter in all versions up t CVE-2024-08495.0Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR.CVE-2024-085110.0Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Grup Arge Energy and Control Systems S CVE-2024-08528.8The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin CVE-2024-08535.3curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequ CVE-2024-08545.4URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.CVE-2024-08555.3The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an CVE-2024-08568.8The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to mak