What’s Vulnerable › Vulnerabilities

CVE-2024-58092: nfsd: fix legacy client tracking initialization

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-16 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization Get rid of the nfsd4_legacy_tracking_ops->init() call in check_for_legacy_methods(). That will be handled in the caller (nfsd4_client_tracking_init()). Otherwise, we'll wind up calling nfsd4_legacy_tracking_ops->init() twice, and the second time we'll trigger the BUG_ON() in nfsd4_init_recdir().

Affected products

• Linux kernel: from 6.8 before 6.12.22; from 6.13 before 6.13.10 — fixed in 6.12.22, 6.13.10

How to fix

Upgrade to a fixed version: Linux kernel 6.12.22, 6.13.10. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/95407304253a4bf03494d921c6913e220c26cc63
• https://git.kernel.org/stable/c/cdd66082b227eb695cbf54b7c121ea032e869981
• https://git.kernel.org/stable/c/de71d4e211eddb670b285a0ea477a299601ce1ca

Get alerted when CVE-2024-58092 or the next vulnerability affects your stack