CVE-2024-53173

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.0: Fix a use-after-free problem in the asynchronous open()

Yang Erkun reports that when two threads are opening files at the same time, and are forced to abort before a reply is seen, then the call to nfs_release_seqid() in nfs4_opendata_free() can result in a use-after-free of the pointer to the defunct rpc task of the other thread. The fix is to ensure that if the RPC call is aborted before the call to nfs_wait_on_sequence() is complete, then we must call nfs_release_seqid() in nfs4_open_release() before the rpc_task is freed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 24ac23ab88df5b21b5b2df8cde748bf99b289099, < 1cfae9575296f5040cdc84b0730e79078c081d2d; >= 24ac23ab88df5b21b5b2df8cde748bf99b289099, < 7bf6bf130af8ee7d93a99c28a7512df3017ec759; >= 24ac23ab88df5b21b5b2df8cde748bf99b289099, < 5237a297ffd374a1c4157a53543b7a69d7bbbc03; >= 24ac23ab88df5b21b5b2df8cde748bf99b289099, < 2ab9639f16b05d948066a6c4cf19a0fdc61046ff; >= 24ac23ab88df5b21b5b2df8cde748bf99b289099, < ba6e6c04f60fe52d91520ac4d749d372d4c74521; >= 24ac23ab88df5b21b5b2df8cde748bf99b289099, < 229a30ed42bb87bcb044c5523fabd9e4f0e75648; >= 24ac23ab88df5b21b5b2df8cde748bf99b289099, < e2277a1d9d5cd0d625a4fd7c04fce2b53e66df77; >= 24ac23ab88df5b21b5b2df8cde748bf99b289099, < b56ae8e715557b4fc227c9381d2e681ffafe7b15; >= 24ac23ab88df5b21b5b2df8cde748bf99b289099, < 2fdb05dc0931250574f0cb0ebeb5ed8e20f4a889
LinuxLinux2.6.16

References

Timeline

Published
Dec 27, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-531747.8In the Linux kernel, the following vulnerability has been resolved: SUNRPC: make sure cache entry active before cache_show The function `cCVE-2024-531755.5In the Linux kernel, the following vulnerability has been resolved: ipc: fix memleak if msg_init_ns failed in create_ipc_ns Percpu memory CVE-2024-531764.7In the Linux kernel, the following vulnerability has been resolved: smb: During unmount, ensure all cached dir instances drop their dentry CVE-2024-531779.8In the Linux kernel, the following vulnerability has been resolved: smb: prevent use-after-free due to open_cached_dir error paths If openCVE-2024-531784.7In the Linux kernel, the following vulnerability has been resolved: smb: Don't leak cfid when reconnect races with open_cached_dir open_caCVE-2024-531797.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of signing key Customers have reportedCVE-2024-53185.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.11 prior to 16.10.6, starting from 16.11 prior to 16.11CVE-2024-531805.5In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Add sanity NULL check for the default mmap fault handler A CVE-2024-531815.5In the Linux kernel, the following vulnerability has been resolved: um: vector: Do not use drvdata in release The drvdata is not availableCVE-2024-531827.8In the Linux kernel, the following vulnerability has been resolved: Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperCVE-2024-531835.5In the Linux kernel, the following vulnerability has been resolved: um: net: Do not use drvdata in release The drvdata is not available inCVE-2024-531845.5In the Linux kernel, the following vulnerability has been resolved: um: ubd: Do not use drvdata in release The drvdata is not available in
CVE-2024-53173: High severity, CVSS 7.8 | Vulnix