CVE-2024-41073 – This CVE describes a double-free vulnerability ... (How to Fix)

Q: What is the severity of CVE-2024-41073?

CVE-2024-41073 has a CVSS score of 7.8 (HIGH). This CVE describes a double-free vulnerability in the Linux kernel's NVMe driver that occurs when discard requests are retried. If exploited, it could lead to kernel memory corruption, potentially causing system crashes or privilege escalation. This affects all Linux systems using NVMe storage devices with the vulnerable kernel version.

📋 TL;DR

This CVE describes a double-free vulnerability in the Linux kernel's NVMe driver that occurs when discard requests are retried. If exploited, it could lead to kernel memory corruption, potentially causing system crashes or privilege escalation. This affects all Linux systems using NVMe storage devices with the vulnerable kernel version.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not specified in CVE; check git commits for exact ranges

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with NVMe storage devices and when discard operations are performed.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to denial of service, or potential privilege escalation allowing attackers to gain root access and execute arbitrary code.

🟠

Likely Case

System instability, crashes, or denial of service affecting NVMe storage operations.

🟢

If Mitigated

Limited impact with proper kernel hardening and isolation; crashes contained to affected storage operations.

🌐 Internet-Facing: LOW - Requires local access or ability to trigger NVMe operations.

🏢 Internal Only: MEDIUM - Local users or processes with NVMe access could trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to trigger NVMe discard operations; likely requires local access or compromised process.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 1b9fd1265fac85916f90b4648de02adccdb7220b, 882574942a9be8b9d70d13462ddacc80c4b385ba, ae84383c96d6662c24697ab6b44aae855ab670aa, c5942a14f795de957ae9d66027aac8ff4fe70057, e5d574ab37f5f2e7937405613d9b1a724811e5ad

Vendor Advisory: https://git.kernel.org/stable/c/1b9fd1265fac85916f90b4648de02adccdb7220b

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable NVMe discard operations

linux

Prevent discard operations on NVMe devices to avoid triggering the vulnerability

echo 0 > /sys/block/nvme*/queue/discard_max_bytes
echo 0 > /sys/block/nvme*/queue/discard_granularity

🧯 If You Can't Patch

Restrict access to NVMe devices to trusted users only
Implement strict process isolation and limit NVMe operations to essential services

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions from git commits; examine if NVMe devices are present

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits; test NVMe discard operations for stability

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
NVMe driver errors in dmesg
System crashes during storage operations

Network Indicators:

None - local vulnerability

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "BUG") AND ("nvme" OR "discard")

📊 Metadata

CVE ID: CVE-2024-41073

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-415

Published: July 29, 2024

Last Updated: January 14, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-41073, you might also want to check these: