CVE-2024-49855

What it actually does

Race condition in the Linux kernel NBD driver between timeout handling in nbd_requeue_cmd() and normal request completion, allowing use-after-free when the NBD_CMD_INFLIGHT flag is not cleared under proper locking.

Why it matters to the business

May cause kernel crashes, system instability, or local privilege escalation on Linux systems that use network block devices, leading to downtime or unauthorized access in storage-dependent environments.

How an attack unfolds

An attacker with local access configures NBD devices, induces request timeouts, and races normal completions against requeue handling to trigger the use-after-free; listed threat actors have targeted similar Linux kernel resource and memory issues in past campaigns.

How to fix it

Update the Linux kernel to the fixed commit 3d7cb6b04c3f3115719235cc6866b10326de34cd in the mainline repository; apply the corresponding stable or distribution backport as soon as available.

How to confirm the fix worked

Confirm the running kernel source or binary contains the commit that clears NBD_CMD_INFLIGHT inside nbd_requeue_cmd() while holding cmd->lock; test NBD timeout paths under load to verify no use-after-free occurs.

Typical attack path

1. Obtain local user access on a Linux host
2. Set up or interact with an NBD device to generate in-flight requests
3. Force or wait for request timeouts
4. Trigger concurrent normal completions to exploit the race
5. Leverage resulting use-after-free for kernel memory corruption or code execution

How to detect it

Examine kernel logs and dmesg for NBD timeout messages followed immediately by use-after-free or general protection fault entries; correlate with process activity involving nbd or block device operations.

What your security team should do

• Prioritize kernel updates on all systems exposing NBD
• Restrict NBD usage to trusted networks and minimal privilege contexts until patched
• Review kernel logs for NBD-related panics or warnings as an interim detection measure