CVE-2024-50087 (GCVE-0-2024-50087)

Vulnerability from cvelistv5 – Published: 2024-10-29 00:50 – Updated: 2026-08-05 11:41
VLAI
Title
btrfs: fix uninitialized pointer free on read_alloc_one_name() error
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix uninitialized pointer free on read_alloc_one_name() error The function read_alloc_one_name() does not initialize the name field of the passed fscrypt_str struct if kmalloc fails to allocate the corresponding buffer. Thus, it is not guaranteed that fscrypt_str.name is initialized when freeing it. This is a follow-up to the linked patch that fixes the remaining instances of the bug introduced by commit e43eec81c516 ("btrfs: use struct qstr instead of name and namelen pairs").
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:23 UTC
CWE
  • CWE-824 - Access of Uninitialized Pointer
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1cf474cd474bc5d3ef63086ffd009a87a5b7bb2e , < b37de9491f140a0ff125c27dd1050185c3accbc1 (git)
Affected: e43eec81c5167b655b72c781b0e75e62a05e415e , < 7fc7c47b9ba0cf2d192f2117a64b24881b0b577f (git)
Affected: e43eec81c5167b655b72c781b0e75e62a05e415e , < 1ec28de5e476913ae51f909660b4447eddb28838 (git)
Affected: e43eec81c5167b655b72c781b0e75e62a05e415e , < 2ab5e243c2266c841e0f6904fad1514b18eaf510 (git)
Affected: 6.1.57 , < 6.1.114 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.1.114 , ≤ 6.1.* (semver)
Unaffected: 6.6.58 , ≤ 6.6.* (semver)
Unaffected: 6.11.5 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50087",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:23:12.303362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-824",
                "description": "CWE-824 Access of Uninitialized Pointer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:20.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:25:20.291Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/tree-log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b37de9491f140a0ff125c27dd1050185c3accbc1",
              "status": "affected",
              "version": "1cf474cd474bc5d3ef63086ffd009a87a5b7bb2e",
              "versionType": "git"
            },
            {
              "lessThan": "7fc7c47b9ba0cf2d192f2117a64b24881b0b577f",
              "status": "affected",
              "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
              "versionType": "git"
            },
            {
              "lessThan": "1ec28de5e476913ae51f909660b4447eddb28838",
              "status": "affected",
              "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
              "versionType": "git"
            },
            {
              "lessThan": "2ab5e243c2266c841e0f6904fad1514b18eaf510",
              "status": "affected",
              "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.114",
              "status": "affected",
              "version": "6.1.57",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/tree-log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.114",
                  "versionStartIncluding": "6.1.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.58",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.5",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix uninitialized pointer free on read_alloc_one_name() error\n\nThe function read_alloc_one_name() does not initialize the name field of\nthe passed fscrypt_str struct if kmalloc fails to allocate the\ncorresponding buffer.  Thus, it is not guaranteed that\nfscrypt_str.name is initialized when freeing it.\n\nThis is a follow-up to the linked patch that fixes the remaining\ninstances of the bug introduced by commit e43eec81c516 (\"btrfs: use\nstruct qstr instead of name and namelen pairs\")."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code executes only in the btrfs mount-time log-replay path (`btrfs_replay_log()` \u2192 `replay_one_buffer()`/`replay_dir_deletes()`), reached through the local `mount()` syscall on a local block device or loop image. There is no remote or adjacent-network path into tree-log replay.\nAC:L - The attacker supplies the image, so log replay is guaranteed to run and can be padded with thousands of dir-index entries, each producing another `kmalloc(GFP_NOFS)` attempt; the required allocation failure is induced by attacker-generated memory pressure (userspace ballooning, or a memcg-constrained mount context), which is within the attacker\u0027s influence rather than beyond it.\nPR:L - In the most severe realistic deployment \u2014 desktops and kiosks running udisks2/removable-media automount, which supports btrfs \u2014 an unprivileged local user mounts an attacker-prepared btrfs volume with a dirty log without holding root, and the concurrent memory-pressure side needs no privileges at all.\nUI:N - The attacker performs the triggering mount themselves via automount of attacker-controlled removable media or a mount helper; no separate victim has to open a file or take any action.\nS:U - The corruption occurs in kernel slab memory during mount and stays entirely within the kernel\u0027s own security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary.\nC:H - `kfree()` on an uninitialized stack value can release a still-live slab object whose stale pointer was left by earlier frames in the same mount call chain, yielding a use-after-free that can be reallocated with attacker-chosen data and read back, exposing arbitrary kernel memory.\nI:H - The arbitrary/premature free gives a classic heap-corruption primitive \u2014 reclaiming the freed object with a sprayed structure permits attacker-controlled writes into kernel objects and potential control-flow hijack.\nA:H - Freeing a wild pointer typically faults inside the allocator or trips slab consistency checks, and the resulting use-after-free corrupts kernel state during mount, producing an oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:32.766Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b37de9491f140a0ff125c27dd1050185c3accbc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fc7c47b9ba0cf2d192f2117a64b24881b0b577f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ec28de5e476913ae51f909660b4447eddb28838"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ab5e243c2266c841e0f6904fad1514b18eaf510"
        }
      ],
      "title": "btrfs: fix uninitialized pointer free on read_alloc_one_name() error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50087",
    "datePublished": "2024-10-29T00:50:30.313Z",
    "dateReserved": "2024-10-21T19:36:19.942Z",
    "dateUpdated": "2026-08-05T11:41:32.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50087",
      "date": "2026-09-21",
      "epss": "0.00214",
      "percentile": "0.1207"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "311F2B7D-7AE0-4373-81B3-7806F9A6E2DE",
                  "versionEndExcluding": "6.1.114",
                  "versionStartIncluding": "6.1.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6B9489BC-825E-4EEE-8D93-F93C801988C8",
                  "versionEndExcluding": "6.6.58",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6E62D61A-F704-44DB-A311-17B7534DA7BC",
                  "versionEndExcluding": "6.11.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix uninitialized pointer free on read_alloc_one_name() error\n\nThe function read_alloc_one_name() does not initialize the name field of\nthe passed fscrypt_str struct if kmalloc fails to allocate the\ncorresponding buffer.  Thus, it is not guaranteed that\nfscrypt_str.name is initialized when freeing it.\n\nThis is a follow-up to the linked patch that fixes the remaining\ninstances of the bug introduced by commit e43eec81c516 (\"btrfs: use\nstruct qstr instead of name and namelen pairs\")."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: fix uninitialized pointer free on read_alloc_one_name() error La funci\u00f3n read_alloc_one_name() no inicializa el campo de nombre de la estructura fscrypt_str pasada si kmalloc no puede asignar el b\u00fafer correspondiente. Por lo tanto, no se garantiza que fscrypt_str.name se inicialice al liberarlo. Este es un seguimiento del parche vinculado que corrige las instancias restantes del error introducido por el commit e43eec81c516 (\"btrfs: use struct qstr instead of name and namelen pairs\")."
        }
      ],
      "id": "CVE-2024-50087",
      "lastModified": "2024-10-30T14:40:16.377",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-29T01:15:05.560",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/1ec28de5e476913ae51f909660b4447eddb28838"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/2ab5e243c2266c841e0f6904fad1514b18eaf510"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/7fc7c47b9ba0cf2d192f2117a64b24881b0b577f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/b37de9491f140a0ff125c27dd1050185c3accbc1"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-824"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2025-01-29T00:00:00.000Z",
      "cve": "CVE-2024-50087",
      "id": "msrc_CVE-2024-50087",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: fix uninitialized pointer free on read_alloc_one_name() error",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50087.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/tree-log.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b37de9491f140a0ff125c27dd1050185c3accbc1",
                    "status": "affected",
                    "version": "1cf474cd474bc5d3ef63086ffd009a87a5b7bb2e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7fc7c47b9ba0cf2d192f2117a64b24881b0b577f",
                    "status": "affected",
                    "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1ec28de5e476913ae51f909660b4447eddb28838",
                    "status": "affected",
                    "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2ab5e243c2266c841e0f6904fad1514b18eaf510",
                    "status": "affected",
                    "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.114",
                    "status": "affected",
                    "version": "6.1.57",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/tree-log.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.2"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.114",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.58",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "311F2B7D-7AE0-4373-81B3-7806F9A6E2DE",
                    "versionEndExcluding": "6.1.114",
                    "versionStartIncluding": "6.1.57",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6B9489BC-825E-4EEE-8D93-F93C801988C8",
                    "versionEndExcluding": "6.6.58",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6E62D61A-F704-44DB-A311-17B7534DA7BC",
                    "versionEndExcluding": "6.11.5",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix uninitialized pointer free on read_alloc_one_name() error\n\nThe function read_alloc_one_name() does not initialize the name field of\nthe passed fscrypt_str struct if kmalloc fails to allocate the\ncorresponding buffer.  Thus, it is not guaranteed that\nfscrypt_str.name is initialized when freeing it.\n\nThis is a follow-up to the linked patch that fixes the remaining\ninstances of the bug introduced by commit e43eec81c516 (\"btrfs: use\nstruct qstr instead of name and namelen pairs\")."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: fix uninitialized pointer free on read_alloc_one_name() error La funci\u00f3n read_alloc_one_name() no inicializa el campo de nombre de la estructura fscrypt_str pasada si kmalloc no puede asignar el b\u00fafer correspondiente. Por lo tanto, no se garantiza que fscrypt_str.name se inicialice al liberarlo. Este es un seguimiento del parche vinculado que corrige las instancias restantes del error introducido por el commit e43eec81c516 (\"btrfs: use struct qstr instead of name and namelen pairs\")."
          }
        ],
        "id": "CVE-2024-50087",
        "lastModified": "2026-08-04T11:21:17.337",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-50087",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:23:12.303362Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-29T01:15:05.560",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1ec28de5e476913ae51f909660b4447eddb28838"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2ab5e243c2266c841e0f6904fad1514b18eaf510"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7fc7c47b9ba0cf2d192f2117a64b24881b0b577f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b37de9491f140a0ff125c27dd1050185c3accbc1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-824"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-824"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T18:33:03+00:00",
      "cve": "CVE-2024-50087",
      "id": "CVE-2024-50087",
      "initial_release_date": "2024-10-29T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix uninitialized pointer free on read_alloc_one_name() error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50087.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:44:00Z",
      "cve": "CVE-2024-50087",
      "id": "CVE-2024-50087",
      "initial_release_date": "2024-10-29T04:15:36Z",
      "product_status:known_affected": "398",
      "product_status:known_not_affected": "474",
      "product_status:recommended": "364",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50087",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50087.json",
      "version": "62"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T22:25:20.291Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-50087",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T20:23:12.303362Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-824",
                    "description": "CWE-824 Access of Uninitialized Pointer",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T15:13:48.548Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/btrfs/tree-log.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "b37de9491f140a0ff125c27dd1050185c3accbc1",
                  "status": "affected",
                  "version": "1cf474cd474bc5d3ef63086ffd009a87a5b7bb2e",
                  "versionType": "git"
                },
                {
                  "lessThan": "7fc7c47b9ba0cf2d192f2117a64b24881b0b577f",
                  "status": "affected",
                  "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
                  "versionType": "git"
                },
                {
                  "lessThan": "1ec28de5e476913ae51f909660b4447eddb28838",
                  "status": "affected",
                  "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
                  "versionType": "git"
                },
                {
                  "lessThan": "2ab5e243c2266c841e0f6904fad1514b18eaf510",
                  "status": "affected",
                  "version": "e43eec81c5167b655b72c781b0e75e62a05e415e",
                  "versionType": "git"
                },
                {
                  "lessThan": "6.1.114",
                  "status": "affected",
                  "version": "6.1.57",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/btrfs/tree-log.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.2"
                },
                {
                  "lessThan": "6.2",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.114",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.58",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.114",
                      "versionStartIncluding": "6.1.57",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.58",
                      "versionStartIncluding": "6.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.5",
                      "versionStartIncluding": "6.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12",
                      "versionStartIncluding": "6.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix uninitialized pointer free on read_alloc_one_name() error\n\nThe function read_alloc_one_name() does not initialize the name field of\nthe passed fscrypt_str struct if kmalloc fails to allocate the\ncorresponding buffer.  Thus, it is not guaranteed that\nfscrypt_str.name is initialized when freeing it.\n\nThis is a follow-up to the linked patch that fixes the remaining\ninstances of the bug introduced by commit e43eec81c516 (\"btrfs: use\nstruct qstr instead of name and namelen pairs\")."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable code executes only in the btrfs mount-time log-replay path (`btrfs_replay_log()` \u2192 `replay_one_buffer()`/`replay_dir_deletes()`), reached through the local `mount()` syscall on a local block device or loop image. There is no remote or adjacent-network path into tree-log replay.\nAC:L - The attacker supplies the image, so log replay is guaranteed to run and can be padded with thousands of dir-index entries, each producing another `kmalloc(GFP_NOFS)` attempt; the required allocation failure is induced by attacker-generated memory pressure (userspace ballooning, or a memcg-constrained mount context), which is within the attacker\u0027s influence rather than beyond it.\nPR:L - In the most severe realistic deployment \u2014 desktops and kiosks running udisks2/removable-media automount, which supports btrfs \u2014 an unprivileged local user mounts an attacker-prepared btrfs volume with a dirty log without holding root, and the concurrent memory-pressure side needs no privileges at all.\nUI:N - The attacker performs the triggering mount themselves via automount of attacker-controlled removable media or a mount helper; no separate victim has to open a file or take any action.\nS:U - The corruption occurs in kernel slab memory during mount and stays entirely within the kernel\u0027s own security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary.\nC:H - `kfree()` on an uninitialized stack value can release a still-live slab object whose stale pointer was left by earlier frames in the same mount call chain, yielding a use-after-free that can be reallocated with attacker-chosen data and read back, exposing arbitrary kernel memory.\nI:H - The arbitrary/premature free gives a classic heap-corruption primitive \u2014 reclaiming the freed object with a sprayed structure permits attacker-controlled writes into kernel objects and potential control-flow hijack.\nA:H - Freeing a wild pointer typically faults inside the allocator or trips slab consistency checks, and the resulting use-after-free corrupts kernel state during mount, producing an oops or panic."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:41:32.766Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/b37de9491f140a0ff125c27dd1050185c3accbc1"
            },
            {
              "url": "https://git.kernel.org/stable/c/7fc7c47b9ba0cf2d192f2117a64b24881b0b577f"
            },
            {
              "url": "https://git.kernel.org/stable/c/1ec28de5e476913ae51f909660b4447eddb28838"
            },
            {
              "url": "https://git.kernel.org/stable/c/2ab5e243c2266c841e0f6904fad1514b18eaf510"
            }
          ],
          "title": "btrfs: fix uninitialized pointer free on read_alloc_one_name() error",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-50087",
        "datePublished": "2024-10-29T00:50:30.313Z",
        "dateReserved": "2024-10-21T19:36:19.942Z",
        "dateUpdated": "2026-08-05T11:41:32.766Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.