CVE-2024-53217

NFSD: Prevent NULL dereference in nfsd4_process_cb_update()

State: Published
Severity: 7.5 High
Published: Dec 27, 2024
Updated: Oct 15, 2026
Reserved: Nov 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent NULL dereference in nfsd4_process_cb_update()

@ses is initialized to NULL. If __nfsd4_find_backchannel() finds no available backchannel session, setup_callback_client() will try to dereference @ses and segfault.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before d9a0d1f6e15859ea7a86a327f28491e23deaaa62Affected dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before cac1405e3ff6685a438e910ad719e0cf06af90eeAffected dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before 752a75811f27300fe8131b0a1efc91960f6f88e7Affected dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before c5d90f9302742985a5078e42ac38de42c364c44aAffected dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before 0c3b0e326f838787d229314d4de83af9c53347e8Affected dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before eb51733ae5fc73d95bd857d5da26f9f65b202a79Affected dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before 03178cd8f67227015debb700123987fe96275cd1Affected dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before 4a4ffc1aa9d618e41ad9151f40966e402e58a5a2Affected dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before 1e02c641c3a43c88cecc08402000418e15578d38Affected
LinuxLinux	2.6.38Affected before 2.6.38Not affected 4.19.325 through 4.19.Not affected 5.4.287 through 5.4.Not affected 5.10.231 through 5.10.Not affected 5.15.174 through 5.15.Not affected 6.1.120 through 6.1.Not affected 6.6.64 through 6.6.Not affected 6.11.11 through 6.11.Not affected 6.12.2 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before d9a0d1f6e15859ea7a86a327f28491e23deaaa62Affected
dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before cac1405e3ff6685a438e910ad719e0cf06af90eeAffected
dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before 752a75811f27300fe8131b0a1efc91960f6f88e7Affected
dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before c5d90f9302742985a5078e42ac38de42c364c44aAffected
dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before 0c3b0e326f838787d229314d4de83af9c53347e8Affected
dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before eb51733ae5fc73d95bd857d5da26f9f65b202a79Affected
dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before 03178cd8f67227015debb700123987fe96275cd1Affected
dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before 4a4ffc1aa9d618e41ad9151f40966e402e58a5a2Affected
dcbeaa68dbbdacbbb330a86c7fc95a28473fc209 to before 1e02c641c3a43c88cecc08402000418e15578d38Affected

LinuxLinux

2.6.38Affected
before 2.6.38Not affected
4.19.325 through 4.19.*Not affected
5.4.287 through 5.4.*Not affected
5.10.231 through 5.10.*Not affected
5.15.174 through 5.15.*Not affected
6.1.120 through 6.1.*Not affected
6.6.64 through 6.6.*Not affected
6.11.11 through 6.11.*Not affected
6.12.2 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.