CVE-2024-50091: dm vdo: don't refer to dedupe_context after releasing it
In the Linux kernel, the following vulnerability has been resolved:
dm vdo: don't refer to dedupecontext after releasing it
Clear the dedupecontext pointer in a datavio whenever ownership of the context is lost, so that vdo can't examine it accidentally.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50091?
CVE-2024-50091 has not been assigned a specific severity rating yet, but it involves a critical issue in the Linux kernel.
How do I fix CVE-2024-50091?
To fix CVE-2024-50091, ensure that you update your Linux kernel to version 6.11.5 or later.
What components are affected by CVE-2024-50091?
CVE-2024-50091 affects Linux kernel versions up to and including 6.11.4.
What is the impact of CVE-2024-50091?
The impact of CVE-2024-50091 could potentially lead to unintended access due to improper handling of the dedupe_context pointer.
Is CVE-2024-50091 being actively exploited?
As of now, there is no public indication that CVE-2024-50091 is being actively exploited in the wild.