What is the CVSS score of CVE-2024-27058?

CVE-2024-27058 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Linux Kernel are affected by CVE-2024-27058?

CVE-2024-27058 impacts Linux kernel systems through a synchronization flaw that can cause unexpected system crashes and data loss when accessed by local users.. A patch is available.

How to fix or mitigate CVE-2024-27058?

Within 24 hours: inventory all Linux systems to identify those running vulnerable kernel versions prior to the patched stable release containing the tmpfs synchronization fix. Within 7 days: deploy the available kernel patch from your distribution's security repository or upstream stable releases to all affected systems and schedule reboots during maintenance windows. Within 30 days: complete patching across your entire Linux infrastructure, verify all systems are running patched kernel versions, and close the ticket in your vulnerability tracking system.

Linux Kernel CVE-2024-27058

HIGH

Race Condition (CWE-362)

2024-05-01 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Race Condition

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition inherently requires winning a narrow timing window, warranting AC:H over the NVD-assigned AC:L; all other metrics unchanged.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 12:55 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:54 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

4.7 (MEDIUM) 7.8 (HIGH)

CVE Published

May 01, 2024 - 13:15 cve.org

MEDIUM 4.7

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tmpfs: fix race on handling dquot rbtree

A syzkaller reproducer found a race while attempting to remove dquot information from the rb tree.

Fetching the rb_tree root node must also be protected by the dqopt->dqio_sem, otherwise, giving the right timing, shmem_release_dquot() will trigger a warning because it couldn't find a node in the tree, when the real reason was the root node changing before the search starts:

Thread 1 Thread 2

shmem_release_dquot() - shmem_{acquire,release}_dquot()
fetch ROOT - Fetch ROOT
acquire dqio_sem
wait dqio_sem
do something, triger a tree rebalance
release dqio_sem
acquire dqio_sem
start searching for the node, but

from the wrong location, missing the node, and triggering a warning.

AnalysisAI

Race condition in the Linux kernel's tmpfs (shmem) subsystem allows a local unprivileged user to trigger kernel memory corruption or a system panic via improper synchronization on the dquot rbtree. The root node of the rbtree is fetched outside the protection of dqopt->dqio_sem in shmem_release_dquot(), allowing a concurrent thread to rebalance the tree before the search begins - causing the searcher to operate from a stale root and miss the target node. Discovered via a syzkaller reproducer; no public exploit exists and EPSS is low (0.48%), but the CVSS impact rating of C:H/I:H/A:H reflects the potential for kernel-level memory unsafety. Upstream patches are available in stable kernel commits but an exact tagged release version has not been independently confirmed.

Technical ContextAI

Tmpfs (shmem) in the Linux kernel supports disk quota tracking via a red-black tree (rbtree) of dquot objects, protected by the dqopt->dqio_sem read-write semaphore. CVE-2024-27058 is rooted in CWE-362 (race condition due to concurrent access to a shared resource with improper synchronization). Specifically, shmem_release_dquot() reads the rbtree root before acquiring the semaphore, while a concurrent path (shmem_acquire/release_dquot) can acquire the semaphore, trigger a tree rebalance, and release it. When the first thread finally acquires the semaphore, it searches from a now-stale root pointer, fails to locate the target node, and fires a kernel WARN_ON - which can escalate to a kernel panic on hardened configurations. The affected CPE is cpe:2.3:o:linux:linux_kernel up through 6.9:rc1. The fix was submitted under reporter ID 416baaa9-dc9f-4396-8d5f-8c081fb06d67 and backported to multiple stable branches.

RemediationAI

Apply the upstream stable kernel patches available at https://git.kernel.org/stable/c/0a69b6b3a026543bc215ccc866d0aea5579e6ce2, https://git.kernel.org/stable/c/617d55b90e73c7b4aa2733ca6cc3f9b72d1124bb, https://git.kernel.org/stable/c/c7077f43f30d817d10a9f8245e51576ac114b2f0, and https://git.kernel.org/stable/c/f82f184874d2761ebaa60dccf577921a0dbb3810. These are upstream fix commits backported to stable branches; a specific tagged release version incorporating all four fixes has not been independently confirmed from available data, so verify with your Linux distribution's kernel errata (e.g., RHSA, USN, DSA). As a compensating control, disabling quota support on tmpfs mounts (remove the usrquota/grpquota mount options) eliminates the code path that triggers the race; this has the trade-off of removing quota enforcement for affected filesystems. Upgrading to a distribution kernel already shipping the fix is preferred over relying on the mount-option workaround.