CVE-2024-50043

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue arises when multiple FREE STATEIDs are sent for the same delegation stateid, potentially leading to use-after-free or counter refcount underflow errors. This occurs because the code drops the client lock before calling nfs4 put stid(), allowing another FREE STATE to find the stateid again, which can result in freeing the stateid and causing either use-after-free or decrementing an already zeroed counter.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.