CVE-2024-49903 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2024-49903?

CVE-2024-49903 has a CVSS score of 7.0 (HIGH). A use-after-free vulnerability in the Linux kernel's JFS filesystem allows race conditions between dbUnmount and jfs_ioc_trim operations, potentially leading to kernel memory corruption. This affects Linux systems using the JFS filesystem. Attackers with local access could exploit this to cause denial of service or potentially escalate privileges.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's JFS filesystem allows race conditions between dbUnmount and jfs_ioc_trim operations, potentially leading to kernel memory corruption. This affects Linux systems using the JFS filesystem. Attackers with local access could exploit this to cause denial of service or potentially escalate privileges.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions before fixes in stable kernels (specific commits: 0c238da83f56, 3126ccde51f5, 4218b31ecc7a, 4ac58f773493, 95accb7183ba)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems using JFS filesystem. Many distributions don't enable JFS by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation allowing full system compromise.

🟠

Likely Case

System instability, kernel crashes, or denial of service affecting JFS-mounted filesystems.

🟢

If Mitigated

Limited to local users with filesystem access; proper access controls reduce exposure.

🌐 Internet-Facing: LOW - Requires local access to the system.

🏢 Internal Only: MEDIUM - Local users or processes could trigger the vulnerability on affected systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger specific JFS operations. Race condition exploitation adds complexity.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel versions with fixes from the referenced commits

Vendor Advisory: https://git.kernel.org/stable/c/0c238da83f56bb895cab1e5851d034ac45b158d1

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing fixes. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable JFS filesystem

linux

Prevent mounting of JFS filesystems to avoid exposure

modprobe -r jfs
echo 'blacklist jfs' >> /etc/modprobe.d/blacklist.conf

Restrict filesystem operations

linux

Limit access to JFS mount operations

chmod 700 /sbin/mount.jfs
setfacl -m u:root:rwx /sbin/mount.jfs

🧯 If You Can't Patch

Avoid using JFS filesystem on production systems
Implement strict access controls to limit who can mount/unmount filesystems

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if JFS module is loaded: uname -r && lsmod | grep jfs

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and check for JFS module: uname -r && modinfo jfs | grep version

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN reports of use-after-free
JFS-related errors in dmesg

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("KASAN" OR "use-after-free" OR "jfs" OR "dbFreeBits")

📊 Metadata

CVE ID: CVE-2024-49903

CVSS v3 Score: 7.0 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: October 21, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-49903, you might also want to check these: