CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux11.0
• linux linux kernel5.3 and later · before 5.4.287
• linux linux kernel5.5 and later · before 5.10.231
• linux linux kernel5.11 and later · before 5.15.174
• linux linux kernel5.16 and later · before 6.1.120
• linux linux kernel6.2 and later · before 6.6.55
• linux linux kernel6.7 and later · before 6.10.14
• linux linux kernel6.11 and later · before 6.11.3

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 5.3affected
  • d5ecebc4900df7f6e8dff0717574668885110553 and later · before 7b222d6cb87077faf56a687a72af1951cf78c8a9affected · git
  • d5ecebc4900df7f6e8dff0717574668885110553 and later · before 73b078e3314d4854fd8286f3ba65c860ddd3a3ddaffected · git
  • d5ecebc4900df7f6e8dff0717574668885110553 and later · before 01cdddde39b065074fd48f07027757783cbf5b7daffected · git
  • d5ecebc4900df7f6e8dff0717574668885110553 and later · before ec79e6170bcae8a6036a4b6960f5e7e59a785601affected · git
  • d5ecebc4900df7f6e8dff0717574668885110553 and later · before c6db81c550cea0c73bd72ef55f579991e0e4ba07affected · git
  • d5ecebc4900df7f6e8dff0717574668885110553 and later · before 803b3a39cb096d8718c0aebc03fd19f11c7dc919affected · git
  • d5ecebc4900df7f6e8dff0717574668885110553 and later · before c173d47b69f07cd7ca08efb4e458adbd4725d8e9affected · git
  • d5ecebc4900df7f6e8dff0717574668885110553 and later · before e2a8910af01653c1c268984855629d71fb81f404affected · git
  • before 5.3not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2024-49991Oct 21, 2024 · drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
  31Monitor
• ← EarlierCVE-2024-49992Oct 21, 2024 · drm/stm: Avoid use-after-free issues with crtc and plane
  31Monitor
• Later →CVE-2024-49999Oct 21, 2024 · afs: Fix the setting of the server responding flag
  22Monitor

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.