CVE-2024-50165 (GCVE-0-2024-50165)

Vulnerability from cvelistv5 – Published: 2024-11-07 09:31 – Updated: 2026-08-05 11:42
VLAI
Title
bpf: Preserve param->string when parsing mount options
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve param->string when parsing mount options In bpf_parse_param(), keep the value of param->string intact so it can be freed later. Otherwise, the kmalloc area pointed to by param->string will be leaked as shown below: unreferenced object 0xffff888118c46d20 (size 8): comm "new_name", pid 12109, jiffies 4295580214 hex dump (first 8 bytes): 61 6e 79 00 38 c9 5c 7e any.8.\~ backtrace (crc e1b7f876): [<00000000c6848ac7>] kmemleak_alloc+0x4b/0x80 [<00000000de9f7d00>] __kmalloc_node_track_caller_noprof+0x36e/0x4a0 [<000000003e29b886>] memdup_user+0x32/0xa0 [<0000000007248326>] strndup_user+0x46/0x60 [<0000000035b3dd29>] __x64_sys_fsconfig+0x368/0x3d0 [<0000000018657927>] x64_sys_call+0xff/0x9f0 [<00000000c0cabc95>] do_syscall_64+0x3b/0xc0 [<000000002f331597>] entry_SYSCALL_64_after_hwframe+0x4b/0x53
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:20 UTC
CWE
  • CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6c1752e0b6ca8c7021d6da3926738d8d88f601a9 , < 5d7a0a426540319327309035509cb768a2f5c2c4 (git)
Affected: 6c1752e0b6ca8c7021d6da3926738d8d88f601a9 , < 1f97c03f43fadc407de5b5cb01c07755053e1c22 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.11.6 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50165",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:20:04.347964Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-401",
                "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:11.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5d7a0a426540319327309035509cb768a2f5c2c4",
              "status": "affected",
              "version": "6c1752e0b6ca8c7021d6da3926738d8d88f601a9",
              "versionType": "git"
            },
            {
              "lessThan": "1f97c03f43fadc407de5b5cb01c07755053e1c22",
              "status": "affected",
              "version": "6c1752e0b6ca8c7021d6da3926738d8d88f601a9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve param-\u003estring when parsing mount options\n\nIn bpf_parse_param(), keep the value of param-\u003estring intact so it can\nbe freed later. Otherwise, the kmalloc area pointed to by param-\u003estring\nwill be leaked as shown below:\n\nunreferenced object 0xffff888118c46d20 (size 8):\n  comm \"new_name\", pid 12109, jiffies 4295580214\n  hex dump (first 8 bytes):\n    61 6e 79 00 38 c9 5c 7e                          any.8.\\~\n  backtrace (crc e1b7f876):\n    [\u003c00000000c6848ac7\u003e] kmemleak_alloc+0x4b/0x80\n    [\u003c00000000de9f7d00\u003e] __kmalloc_node_track_caller_noprof+0x36e/0x4a0\n    [\u003c000000003e29b886\u003e] memdup_user+0x32/0xa0\n    [\u003c0000000007248326\u003e] strndup_user+0x46/0x60\n    [\u003c0000000035b3dd29\u003e] __x64_sys_fsconfig+0x368/0x3d0\n    [\u003c0000000018657927\u003e] x64_sys_call+0xff/0x9f0\n    [\u003c00000000c0cabc95\u003e] do_syscall_64+0x3b/0xc0\n    [\u003c000000002f331597\u003e] entry_SYSCALL_64_after_hwframe+0x4b/0x53"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the fsopen(2)/fsconfig(2) syscall pair (or mount(2) with monolithic options) against the bpf filesystem, requiring local system access. There is no remote or adjacent-network path to bpffs mount-option parsing.\nAC:L - A single deterministic fsconfig() call with delegate_cmds=\"x:any\" reliably triggers the interior-pointer kfree(), and a trivial loop reliably drives the unbounded leak; no race, timing window, or uncontrollable precondition is involved. CONFIG_BPF_SYSCALL/bpffs is enabled in essentially all distribution kernels.\nPR:L - bpf_fs_type is FS_USERNS_MOUNT and fsopen() only requires ns_capable(mnt_ns-\u003euser_ns, CAP_SYS_ADMIN), so any unprivileged user can reach bpf_parse_param() via unshare -Urm. The CAP_SYS_ADMIN check on delegation options executes only after the buggy strsep loop, so it provides no protection.\nUI:N - The attacker performs the entire sequence \u2014 create a user/mount namespace, fsopen the bpf filesystem, issue fsconfig \u2014 with no action by any other user. No victim must mount anything or open any file.\nS:U - The corruption and resource exhaustion occur in the kernel slab allocator of the same host, within the same security authority. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - Freeing an interior pointer inserts a misaligned address into the SLUB freelist, so a subsequent allocation returns a chunk overlapping adjacent live objects \u2014 a type-confusion/aliasing primitive that lets the attacker read kernel data belonging to other allocations. Per kernel scoring guidance, slab corruption of this class is treated as a full confidentiality compromise.\nI:H - The same misaligned kfree() causes set_freepointer() to write a heap pointer out of bounds of the freed chunk and hands out overlapping allocations, giving an attacker-usable write primitive over adjacent slab objects. Heap freelist corruption of this kind is the standard basis for privilege escalation.\nA:H - Slab freelist corruption produces kernel panics/oopses (and is caught immediately as an invalid free on KASAN/SLUB_DEBUG builds), and the leak variant lets an unprivileged user drain kernel memory in an unbounded loop until OOM. Either path yields a full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:13.725Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5d7a0a426540319327309035509cb768a2f5c2c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f97c03f43fadc407de5b5cb01c07755053e1c22"
        }
      ],
      "title": "bpf: Preserve param-\u003estring when parsing mount options",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50165",
    "datePublished": "2024-11-07T09:31:41.923Z",
    "dateReserved": "2024-10-21T19:36:19.962Z",
    "dateUpdated": "2026-08-05T11:42:13.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50165",
      "date": "2026-09-20",
      "epss": "0.002",
      "percentile": "0.10154"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2132686D-AA83-479C-98CA-4B9F24436525",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve param-\u003estring when parsing mount options\n\nIn bpf_parse_param(), keep the value of param-\u003estring intact so it can\nbe freed later. Otherwise, the kmalloc area pointed to by param-\u003estring\nwill be leaked as shown below:\n\nunreferenced object 0xffff888118c46d20 (size 8):\n  comm \"new_name\", pid 12109, jiffies 4295580214\n  hex dump (first 8 bytes):\n    61 6e 79 00 38 c9 5c 7e                          any.8.\\~\n  backtrace (crc e1b7f876):\n    [\u003c00000000c6848ac7\u003e] kmemleak_alloc+0x4b/0x80\n    [\u003c00000000de9f7d00\u003e] __kmalloc_node_track_caller_noprof+0x36e/0x4a0\n    [\u003c000000003e29b886\u003e] memdup_user+0x32/0xa0\n    [\u003c0000000007248326\u003e] strndup_user+0x46/0x60\n    [\u003c0000000035b3dd29\u003e] __x64_sys_fsconfig+0x368/0x3d0\n    [\u003c0000000018657927\u003e] x64_sys_call+0xff/0x9f0\n    [\u003c00000000c0cabc95\u003e] do_syscall_64+0x3b/0xc0\n    [\u003c000000002f331597\u003e] entry_SYSCALL_64_after_hwframe+0x4b/0x53"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: preservar param-\u0026gt;string al analizar las opciones de montaje. En bpf_parse_param(), mantenga intacto el valor de param-\u0026gt;string para que pueda liberarse m\u00e1s tarde. De lo contrario, el \u00e1rea kmalloc a la que apunta param-\u0026gt;string se filtrar\u00e1 como se muestra a continuaci\u00f3n: objeto sin referencia 0xffff888118c46d20 (tama\u00f1o 8): comm \"new_name\", pid 12109, jiffies 4295580214 volcado hexadecimal (primeros 8 bytes): 61 6e 79 00 38 c9 5c 7e any.8.\\~ backtrace (crc e1b7f876): [\u0026lt;00000000c6848ac7\u0026gt;] kmemleak_alloc+0x4b/0x80 [\u0026lt;00000000de9f7d00\u0026gt;] __kmalloc_node_track_caller_noprof+0x36e/0x4a0 [\u0026lt;000000003e29b886\u0026gt;] memdup_user+0x32/0xa0 [\u0026lt;0000000007248326\u0026gt;] strndup_user+0x46/0x60 [\u0026lt;0000000035b3dd29\u0026gt;] __x64_sys_fsconfig+0x368/0x3d0 [\u0026lt;0000000018657927\u0026gt;] x64_sys_call+0xff/0x9f0 [\u0026lt;00000000c0cabc95\u0026gt;] do_syscall_64+0x3b/0xc0 [\u0026lt;000000002f331597\u0026gt;] entrada_SYSCALL_64_after_hwframe+0x4b/0x53"
        }
      ],
      "id": "CVE-2024-50165",
      "lastModified": "2024-11-22T16:53:05.527",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-11-07T10:15:07.770",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/1f97c03f43fadc407de5b5cb01c07755053e1c22"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/5d7a0a426540319327309035509cb768a2f5c2c4"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-401"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5d7a0a426540319327309035509cb768a2f5c2c4",
                    "status": "affected",
                    "version": "6c1752e0b6ca8c7021d6da3926738d8d88f601a9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1f97c03f43fadc407de5b5cb01c07755053e1c22",
                    "status": "affected",
                    "version": "6c1752e0b6ca8c7021d6da3926738d8d88f601a9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.9"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2132686D-AA83-479C-98CA-4B9F24436525",
                    "versionEndExcluding": "6.11.6",
                    "versionStartIncluding": "6.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve param-\u003estring when parsing mount options\n\nIn bpf_parse_param(), keep the value of param-\u003estring intact so it can\nbe freed later. Otherwise, the kmalloc area pointed to by param-\u003estring\nwill be leaked as shown below:\n\nunreferenced object 0xffff888118c46d20 (size 8):\n  comm \"new_name\", pid 12109, jiffies 4295580214\n  hex dump (first 8 bytes):\n    61 6e 79 00 38 c9 5c 7e                          any.8.\\~\n  backtrace (crc e1b7f876):\n    [\u003c00000000c6848ac7\u003e] kmemleak_alloc+0x4b/0x80\n    [\u003c00000000de9f7d00\u003e] __kmalloc_node_track_caller_noprof+0x36e/0x4a0\n    [\u003c000000003e29b886\u003e] memdup_user+0x32/0xa0\n    [\u003c0000000007248326\u003e] strndup_user+0x46/0x60\n    [\u003c0000000035b3dd29\u003e] __x64_sys_fsconfig+0x368/0x3d0\n    [\u003c0000000018657927\u003e] x64_sys_call+0xff/0x9f0\n    [\u003c00000000c0cabc95\u003e] do_syscall_64+0x3b/0xc0\n    [\u003c000000002f331597\u003e] entry_SYSCALL_64_after_hwframe+0x4b/0x53"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: preservar param-\u0026gt;string al analizar las opciones de montaje. En bpf_parse_param(), mantenga intacto el valor de param-\u0026gt;string para que pueda liberarse m\u00e1s tarde. De lo contrario, el \u00e1rea kmalloc a la que apunta param-\u0026gt;string se filtrar\u00e1 como se muestra a continuaci\u00f3n: objeto sin referencia 0xffff888118c46d20 (tama\u00f1o 8): comm \"new_name\", pid 12109, jiffies 4295580214 volcado hexadecimal (primeros 8 bytes): 61 6e 79 00 38 c9 5c 7e any.8.\\~ backtrace (crc e1b7f876): [\u0026lt;00000000c6848ac7\u0026gt;] kmemleak_alloc+0x4b/0x80 [\u0026lt;00000000de9f7d00\u0026gt;] __kmalloc_node_track_caller_noprof+0x36e/0x4a0 [\u0026lt;000000003e29b886\u0026gt;] memdup_user+0x32/0xa0 [\u0026lt;0000000007248326\u0026gt;] strndup_user+0x46/0x60 [\u0026lt;0000000035b3dd29\u0026gt;] __x64_sys_fsconfig+0x368/0x3d0 [\u0026lt;0000000018657927\u0026gt;] x64_sys_call+0xff/0x9f0 [\u0026lt;00000000c0cabc95\u0026gt;] do_syscall_64+0x3b/0xc0 [\u0026lt;000000002f331597\u0026gt;] entrada_SYSCALL_64_after_hwframe+0x4b/0x53"
          }
        ],
        "id": "CVE-2024-50165",
        "lastModified": "2026-08-04T11:21:27.853",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-50165",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:20:04.347964Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-11-07T10:15:07.770",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1f97c03f43fadc407de5b5cb01c07755053e1c22"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5d7a0a426540319327309035509cb768a2f5c2c4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T12:21:21+00:00",
      "cve": "CVE-2024-50165",
      "id": "CVE-2024-50165",
      "initial_release_date": "2024-11-07T00:00:00+00:00",
      "product_status:known_affected": "136",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Preserve param-\u003estring when parsing mount options",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50165.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:18:48Z",
      "cve": "CVE-2024-50165",
      "id": "CVE-2024-50165",
      "initial_release_date": "2024-11-08T03:48:48Z",
      "product_status:known_not_affected": "476",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50165",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50165.json",
      "version": "24"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-50165",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T20:20:04.347964Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-401",
                    "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T15:18:46.095Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "kernel/bpf/inode.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "5d7a0a426540319327309035509cb768a2f5c2c4",
                  "status": "affected",
                  "version": "6c1752e0b6ca8c7021d6da3926738d8d88f601a9",
                  "versionType": "git"
                },
                {
                  "lessThan": "1f97c03f43fadc407de5b5cb01c07755053e1c22",
                  "status": "affected",
                  "version": "6c1752e0b6ca8c7021d6da3926738d8d88f601a9",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "kernel/bpf/inode.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.9"
                },
                {
                  "lessThan": "6.9",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.6",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.6",
                      "versionStartIncluding": "6.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12",
                      "versionStartIncluding": "6.9",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve param-\u003estring when parsing mount options\n\nIn bpf_parse_param(), keep the value of param-\u003estring intact so it can\nbe freed later. Otherwise, the kmalloc area pointed to by param-\u003estring\nwill be leaked as shown below:\n\nunreferenced object 0xffff888118c46d20 (size 8):\n  comm \"new_name\", pid 12109, jiffies 4295580214\n  hex dump (first 8 bytes):\n    61 6e 79 00 38 c9 5c 7e                          any.8.\\~\n  backtrace (crc e1b7f876):\n    [\u003c00000000c6848ac7\u003e] kmemleak_alloc+0x4b/0x80\n    [\u003c00000000de9f7d00\u003e] __kmalloc_node_track_caller_noprof+0x36e/0x4a0\n    [\u003c000000003e29b886\u003e] memdup_user+0x32/0xa0\n    [\u003c0000000007248326\u003e] strndup_user+0x46/0x60\n    [\u003c0000000035b3dd29\u003e] __x64_sys_fsconfig+0x368/0x3d0\n    [\u003c0000000018657927\u003e] x64_sys_call+0xff/0x9f0\n    [\u003c00000000c0cabc95\u003e] do_syscall_64+0x3b/0xc0\n    [\u003c000000002f331597\u003e] entry_SYSCALL_64_after_hwframe+0x4b/0x53"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T20:46:42.131Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/5d7a0a426540319327309035509cb768a2f5c2c4"
            },
            {
              "url": "https://git.kernel.org/stable/c/1f97c03f43fadc407de5b5cb01c07755053e1c22"
            }
          ],
          "title": "bpf: Preserve param-\u003estring when parsing mount options",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-50165",
        "datePublished": "2024-11-07T09:31:41.923Z",
        "dateReserved": "2024-10-21T19:36:19.962Z",
        "dateUpdated": "2026-05-11T20:46:42.131Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.