CVE-2024-41049

filelock: fix potential use-after-free in posix_lock_inode

State: Published
Severity: 7.8 High
Published: Jul 29, 2024
Updated: Aug 5, 2026
Reserved: Jul 12, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

filelock: fix potential use-after-free in posix_lock_inode

Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was added to the inode's list. However, before the tracepoint could fire, another task raced in and freed that lock.

Fix this by moving the tracepoint inside the spinlock, which should ensure that this doesn't happen.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	117fb80cd1e63c419c7a221ce070becb4bfc7b6d to before 1cbbb3d9475c403ebedc327490c7c2b991398197Affected a6f4129378ca15f62cbdde09a7d3ccc35adcf49d to before 7d4c14f4b511fd4c0dc788084ae59b4656ace58bAffected 766e56faddbec2eaf70c9299e1c9ef74d846d32b to before 02a8964260756c70b20393ad4006948510ac9967Affected 34bff6d850019e00001129d6de3aa4874c2cf471 to before 5cb36e35bc10ea334810937990c2b9023dacb1b0Affected 74f6f5912693ce454384eaeec48705646a21c74f to before 432b06b69d1d354a171f7499141116536579eb6aAffected 74f6f5912693ce454384eaeec48705646a21c74f to before 116599f6a26906cf33f67975c59f0692ecf7e9b2Affected 74f6f5912693ce454384eaeec48705646a21c74f to before 1b3ec4f7c03d4b07bad70697d7e2f4088d2cfe92Affected e75396988bb9b3b90e6e8690604d0f566cea403aAffected 5.4.257 to before 5.4.280Affected 5.10.197 to before 5.10.222Affected 5.15.133 to before 5.15.163Affected 6.1.55 to before 6.1.100Affected 6.5.5 to before 6.6Affected
LinuxLinux	6.6Affected before 6.6Not affected 5.4.280 through 5.4.Not affected 5.10.222 through 5.10.Not affected 5.15.163 through 5.15.Not affected 6.1.100 through 6.1.Not affected 6.6.41 through 6.6.Not affected 6.9.10 through 6.9.Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

117fb80cd1e63c419c7a221ce070becb4bfc7b6d to before 1cbbb3d9475c403ebedc327490c7c2b991398197Affected
a6f4129378ca15f62cbdde09a7d3ccc35adcf49d to before 7d4c14f4b511fd4c0dc788084ae59b4656ace58bAffected
766e56faddbec2eaf70c9299e1c9ef74d846d32b to before 02a8964260756c70b20393ad4006948510ac9967Affected
34bff6d850019e00001129d6de3aa4874c2cf471 to before 5cb36e35bc10ea334810937990c2b9023dacb1b0Affected
74f6f5912693ce454384eaeec48705646a21c74f to before 432b06b69d1d354a171f7499141116536579eb6aAffected
74f6f5912693ce454384eaeec48705646a21c74f to before 116599f6a26906cf33f67975c59f0692ecf7e9b2Affected
74f6f5912693ce454384eaeec48705646a21c74f to before 1b3ec4f7c03d4b07bad70697d7e2f4088d2cfe92Affected
e75396988bb9b3b90e6e8690604d0f566cea403aAffected
5.4.257 to before 5.4.280Affected
5.10.197 to before 5.10.222Affected
5.15.133 to before 5.15.163Affected
6.1.55 to before 6.1.100Affected
6.5.5 to before 6.6Affected

LinuxLinux

6.6Affected
before 6.6Not affected
5.4.280 through 5.4.*Not affected
5.10.222 through 5.10.*Not affected
5.15.163 through 5.15.*Not affected
6.1.100 through 6.1.*Not affected
6.6.41 through 6.6.*Not affected
6.9.10 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.