What’s Vulnerable › Vulnerabilities

CVE-2024-35914: nfsd: Fix error cleanup path in nfsd_rename()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-19 · updated 2026-08-04
• Weakness: CWE-667

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix error cleanup path in nfsd_rename() Commit a8b0026847b8 ("rename(): avoid a deadlock in the case of parents having no common ancestor") added an error bail out path. However this path does not drop the remount protection that has been acquired. Fix the cleanup path to properly drop the remount protection.

Affected products

• Linux kernel: from 6.8 before 6.8.5; 6.9-rc1 — fixed in 6.8.5

How to fix

Upgrade to a fixed version: Linux kernel 6.8.5. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd
• https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56
• https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd
• https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56

Get alerted when CVE-2024-35914 or the next vulnerability affects your stack