CVE-2024-35914

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-35914", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.122Z", "datePublished": "2024-05-19T08:35:07.367Z", "dateUpdated": "2026-08-05T11:30:56.369Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:56.369Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Fix error cleanup path in nfsd_rename()\n\nCommit a8b0026847b8 (\"rename(): avoid a deadlock in the case of parents\nhaving no common ancestor\") added an error bail out path. However this\npath does not drop the remount protection that has been acquired. Fix\nthe cleanup path to properly drop the remount protection."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is in the in-kernel NFS server (nfsd) and is reached purely by sending an NFSv2/v3 RENAME RPC or an NFSv4 COMPOUND containing RENAME over TCP/2049. No local access to the server is needed.\nAC:L - The remote client supplies both directory filehandles itself and can retry the request an unbounded number of times; nfsd explicitly tolerates DCACHE_DISCONNECTED directory dentries (it only warns), so the lock_rename() -EXDEV bail-out is reachable from client-controlled input rather than depending on a condition the attacker cannot influence.\nPR:N - With the standard AUTH_SYS/AUTH_UNIX export configuration nfsd performs no cryptographic authentication \u2014 the client asserts its own uid/gid, so the fh_verify() NFSD_MAY_REMOVE/NFSD_MAY_CREATE checks are satisfied by a self-declared identity. Any host permitted by the export list can trigger it with no privileges on the server.\nUI:N - The attacking NFS client drives the entire sequence itself by issuing RENAME requests; no administrator or user action on the server is required.\nS:U - The leaked mnt_want_write()/sb_start_write() reference affects only the exported filesystem within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an unbalanced mount write-access/freeze-protection reference on an error path; no memory is read out of bounds, no kernel pointer or file content is exposed, and the rename itself never executes.\nI:N - Nothing is written or modified \u2014 the operation fails with NFS3ERR_XDEV/NFSERR_ACCES and returns; there is no memory corruption or arbitrary-write primitive of any kind.\nA:H - The error path returns while still holding the export's remount/freeze protection, and a remote client can drive it repeatedly across concurrent connections to keep write references pinned on the exported filesystem, indefinitely stalling fsfreeze and remount-read-only (snapshot/backup) operations on that mount."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/vfs.c"], "versions": [{"version": "a8b0026847b8c43445c921ad2c85521c92eb175f", "lessThan": "331e125e02c08ffaecc1074af78a988a278039bd", "status": "affected", "versionType": "git"}, {"version": "a8b0026847b8c43445c921ad2c85521c92eb175f", "lessThan": "9fe6e9e7b58944037714442384075c17cfde1c56", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/vfs.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.8.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd"}, {"url": "https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56"}], "title": "nfsd: Fix error cleanup path in nfsd_rename()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-18T16:53:51.345113Z", "id": "CVE-2024-35914", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-18T16:54:02.746Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.929Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.929Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35914", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-18T16:53:51.345113Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-18T16:53:59.236Z"}}], "cna": {"title": "nfsd: Fix error cleanup path in nfsd_rename()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is in the in-kernel NFS server (nfsd) and is reached purely by sending an NFSv2/v3 RENAME RPC or an NFSv4 COMPOUND containing RENAME over TCP/2049. No local access to the server is needed.\nAC:L - The remote client supplies both directory filehandles itself and can retry the request an unbounded number of times; nfsd explicitly tolerates DCACHE_DISCONNECTED directory dentries (it only warns), so the lock_rename() -EXDEV bail-out is reachable from client-controlled input rather than depending on a condition the attacker cannot influence.\nPR:N - With the standard AUTH_SYS/AUTH_UNIX export configuration nfsd performs no cryptographic authentication \u2014 the client asserts its own uid/gid, so the fh_verify() NFSD_MAY_REMOVE/NFSD_MAY_CREATE checks are satisfied by a self-declared identity. Any host permitted by the export list can trigger it with no privileges on the server.\nUI:N - The attacking NFS client drives the entire sequence itself by issuing RENAME requests; no administrator or user action on the server is required.\nS:U - The leaked mnt_want_write()/sb_start_write() reference affects only the exported filesystem within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an unbalanced mount write-access/freeze-protection reference on an error path; no memory is read out of bounds, no kernel pointer or file content is exposed, and the rename itself never executes.\nI:N - Nothing is written or modified \u2014 the operation fails with NFS3ERR_XDEV/NFSERR_ACCES and returns; there is no memory corruption or arbitrary-write primitive of any kind.\nA:H - The error path returns while still holding the export's remount/freeze protection, and a remote client can drive it repeatedly across concurrent connections to keep write references pinned on the exported filesystem, indefinitely stalling fsfreeze and remount-read-only (snapshot/backup) operations on that mount."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a8b0026847b8c43445c921ad2c85521c92eb175f", "lessThan": "331e125e02c08ffaecc1074af78a988a278039bd", "versionType": "git"}, {"status": "affected", "version": "a8b0026847b8c43445c921ad2c85521c92eb175f", "lessThan": "9fe6e9e7b58944037714442384075c17cfde1c56", "versionType": "git"}], "programFiles": ["fs/nfsd/vfs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.8.5", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfsd/vfs.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd"}, {"url": "https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Fix error cleanup path in nfsd_rename()\n\nCommit a8b0026847b8 (\"rename(): avoid a deadlock in the case of parents\nhaving no common ancestor\") added an error bail out path. However this\npath does not drop the remount protection that has been acquired. Fix\nthe cleanup path to properly drop the remount protection."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.5", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "6.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:56.369Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35914", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:30:56.369Z", "dateReserved": "2024-05-17T13:50:33.122Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-19T08:35:07.367Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "331e125e02c08ffaecc1074af78a988a278039bd", "status": "affected", "version": "a8b0026847b8c43445c921ad2c85521c92eb175f", "versionType": "git"}, {"lessThan": "9fe6e9e7b58944037714442384075c17cfde1c56", "status": "affected", "version": "a8b0026847b8c43445c921ad2c85521c92eb175f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7733C2C9-77AB-41F9-BE33-99FF60A64DBB", "versionEndExcluding": "6.8.5", "versionStartIncluding": "6.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Fix error cleanup path in nfsd_rename()\n\nCommit a8b0026847b8 (\"rename(): avoid a deadlock in the case of parents\nhaving no common ancestor\") added an error bail out path. However this\npath does not drop the remount protection that has been acquired. Fix\nthe cleanup path to properly drop the remount protection."}, {"lang": "es", "value": " En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: corrigi\u00f3 la ruta de limpieza de errores en nfsd_rename() Confirme a8b0026847b8 (\"rename(): evite un punto muerto en el caso de que los padres no tengan un ancestro com\u00fan\") agreg\u00f3 una ruta de rescate de errores . Sin embargo, este camino no elimina la protecci\u00f3n de remontaje adquirida. Corrija la ruta de limpieza para eliminar correctamente la protecci\u00f3n de remontaje."}], "id": "CVE-2024-35914", "lastModified": "2026-08-04T11:18:10.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35914", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-18T16:53:51.345113Z", "version": "2.0.3"}}]}, "published": "2024-05-19T09:15:11.910", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nfsd: Fix error cleanup path in nfsd_rename()", "id": "2281632", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281632"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnfsd: Fix error cleanup path in nfsd_rename()\nCommit a8b0026847b8 (\"rename(): avoid a deadlock in the case of parents\nhaving no common ancestor\") added an error bail out path. However this\npath does not drop the remount protection that has been acquired. Fix\nthe cleanup path to properly drop the remount protection."], "name": "CVE-2024-35914", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35914\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35914\nhttps://lore.kernel.org/linux-cve-announce/2024051957-CVE-2024-35914-3194@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-12T22:44:42.650705+00:00", "updated": "2025-07-12T22:44:42.650768+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}