CVE-2024-49960

A flaw was found in the Linux kernel's ext4 file system. This vulnerability allows a local user to cause a Denial of Service (DoS) or kernel memory corruption through a use-after-free condition. When an ext4 file system mount operation fails, an input/output (I/O) error can restart an error-reporting timer after it was scheduled for cancellation, leaving it running after the associated memory structure has been freed. A local user with permissions to mount storage devices could exploit this issue by mounting a corrupted file system image, resulting in an operating system crash.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires local privileges or physical access to mount a specially crafted or corrupted filesystem image, limiting the blast radius to a denial of service. Under default system configurations, mounting storage devices requires administrative privileges with root permissions, significantly constraining exposure in standard environments. A local privileged user or attacker able to trigger a mount failure accompanied by I/O errors could cause kernel memory corruption or an operating system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.