CVE-2024-50277

What it actually does

The vulnerability causes a kernel crash when blk_alloc_disk fails for a mapped device; cleanup_mapped_device dereferences an error pointer stored in md->disk instead of NULL, leading to invalid memory access.

Why it matters to the business

Systems may experience unexpected crashes or denial of service during device mapper operations, potentially affecting storage availability; low EPSS and absence from KEV indicate limited immediate operational risk despite broad Linux kernel exposure.

How an attack unfolds

An attacker triggers a blk_alloc_disk failure during mapped device setup to force cleanup_mapped_device execution, resulting in a crash from dereferencing the error value; no confirmed exploitation by listed threat actors or ransomware campaigns.

How to fix it

Update the Linux kernel to a version containing the fix for error pointer handling in device mapper cleanup; apply available package updates for affected distributions.

How to confirm the fix worked

Confirm updated kernel version includes the dm fix; reproduce allocation failure scenarios in testing to ensure no crash occurs on cleanup.

Typical attack path

1. Trigger allocation failure in blk_alloc_disk during device mapper initialization
2. Invoke cleanup_mapped_device on the partially constructed device
3. Dereference md->disk error pointer causing kernel panic

How to detect it

Review kernel logs and oops reports for device mapper cleanup crashes; correlate with mapped device creation attempts around failure events.

What your security team should do

• Prioritize kernel updates in affected environments
• Monitor device mapper related kernel logs for panics
• Test storage configurations under failure conditions post-update