CVE-2024-14027

In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a file reference but returns early without calling fdput() when strncpy_from_user() fails on the name argument. In multi-threaded processes where fdget() takes the slow path, this permanently leaks one file reference per call, pinning the struct file and associated kernel objects in memory. An unprivileged local user can exploit this to cause kernel memory exhaustion. The issue was inadvertently fixed by commit a71874379ec8 ("xattr: switch to CLASS(fd)").

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/9a3a2ae5efbbcaed37551218abed94e23c537157	Patch
https://git.kernel.org/stable/c/a71874379ec8c6e788a61d71b3ad014a8d9a5c08	Patch
https://git.kernel.org/stable/c/d151b94967c8247005435b63fc60f8f4baa320da	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

No history.

Information

Published : 2026-03-09 16:16

Updated : 2026-06-26 20:18

NVD link : CVE-2024-14027

Mitre link : CVE-2024-14027

CVE.ORG link : CVE-2024-14027

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2024-14027", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c03185f4a23e7f89d84c9981091770e876e64480", "lessThan": "9a3a2ae5efbbcaed37551218abed94e23c537157", "versionType": "git"}, {"status": "affected", "version": "c3a5e3e872f3688ae0dc57bb78ca633921d96a91", "lessThan": "d151b94967c8247005435b63fc60f8f4baa320da", "versionType": "git"}, {"status": "affected", "version": "c3a5e3e872f3688ae0dc57bb78ca633921d96a91", "lessThan": "a71874379ec8c6e788a61d71b3ad014a8d9a5c08", "versionType": "git"}, {"status": "affected", "version": "8d5863cb33aa424fc27115ee945ad6b96ae2facb", "versionType": "git"}, {"status": "affected", "version": "6.6.51", "lessThan": "6.6.133", "versionType": "semver"}, {"status": "affected", "version": "6.10.10", "lessThan": "6.11", "versionType": "semver"}], "programFiles": ["fs/xattr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.133", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.77", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/xattr.c"], "defaultStatus": "affected"}]}], "published": "2026-03-09T16:16:14.313", "references": [{"url": "https://git.kernel.org/stable/c/9a3a2ae5efbbcaed37551218abed94e23c537157", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a71874379ec8c6e788a61d71b3ad014a8d9a5c08", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d151b94967c8247005435b63fc60f8f4baa320da", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/xattr: missing fdput() in fremovexattr error path\n\nIn the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a\nfile reference but returns early without calling fdput() when\nstrncpy_from_user() fails on the name argument. In multi-threaded processes\nwhere fdget() takes the slow path, this permanently leaks one\nfile reference per call, pinning the struct file and associated kernel\nobjects in memory. An unprivileged local user can exploit this to cause\nkernel memory exhaustion. The issue was inadvertently fixed by commit\na71874379ec8 (\"xattr: switch to CLASS(fd)\")."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfs/xattr: falta fdput() en la ruta de error de fremovexattr\n\nEn el kernel de Linux, la llamada al sistema fremovexattr() llama a fdget() para adquirir una referencia de archivo, pero retorna prematuramente sin llamar a fdput() cuando strncpy_from_user() falla en el argumento 'name'. En procesos multihilo donde fdget() toma la ruta lenta, esto fuga permanentemente una referencia de archivo por llamada, fijando la estructura 'struct file' y los objetos del kernel asociados en memoria. Un usuario local sin privilegios puede explotar esto para causar agotamiento de la memoria del kernel. El problema fue corregido inadvertidamente por el commit a71874379ec8 ('xattr: switch to CLASS(fd)')."}], "lastModified": "2026-06-26T20:18:19.230", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B87E886F-56D4-4D9C-AE13-088E1851614A", "versionEndExcluding": "6.6.133", "versionStartIncluding": "6.6.51"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F0B9738-892B-4C33-A6BE-FBE212579E9B", "versionEndExcluding": "6.12.77", "versionStartIncluding": "6.10.10"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}