CVE-2024-49883

A flaw was found in the Linux kernel's ext4 filesystem driver. When modifying filesystem structures during extent allocation, the kernel fails to update an internal path reference after reallocation, resulting in a use-after-free vulnerability where memory is accessed after being deallocated. A local user with write privileges on an ext4 filesystem can exploit this issue during writeback or block mapping operations to cause a Denial of Service (DoS) by crashing the kernel, or potentially corrupt system memory.

This vulnerability is rated as Moderate because exploitation requires a local user to have write privileges on an ext4 filesystem, with the resulting impact primarily limited to a kernel crash and denial of service. While ext4 is fully supported across Red Hat Enterprise Linux releases, standard installations deploy XFS by default, restricting potential exposure to systems actively utilizing ext4 storage volumes. Exploitation relies on specific extent tree reallocation conditions during block mapping and writeback, preventing remote or unprivileged triggering on default configurations without ext4 write access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.