CVE-2024-49855

A flaw was found in the Network Block Device (NBD) driver within the Linux kernel. A race condition exists between the handling of request timeouts and normal completion. This timing issue can allow a local attacker to trigger a use-after-free vulnerability, potentially leading to memory corruption or a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If Network Block Device (NBD) functionality is not actively used, the nbd kernel module can be prevented from loading. Create a file /etc/modprobe.d/blacklist-nbd.conf with the content blacklist nbd. After saving the file, regenerate the initramfs and reboot the system for the changes to take effect. This action will disable NBD functionality.