What is the CVSS score of CVE-2024-35948?

CVE-2024-35948 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-35948?

CVE-2024-35948 enables local privilege escalation on Linux systems using bcachefs, potentially allowing unauthorized users to gain system control.. A patch is available.

How to fix or mitigate CVE-2024-35948?

Within 24 hours, audit systems inventory to identify any deployments using bcachefs filesystem on Linux kernels up to version 6.9-rc5 and document affected systems. Within 7 days, obtain the patched Linux kernel version from your vendor, test it in non-production environments to ensure stability with your workload configurations, then plan phased deployment. Complete patching across all identified affected systems within 30 days, prioritizing production infrastructure; verify kernel version updates using 'uname -r' post-patch and confirm bcachefs mounts remain stable.

Linux Kernel CVE-2024-35948

HIGH

Uncontrolled Resource Consumption (CWE-400)

2024-05-20 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Denial Of Service Linux

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector required to mount crafted volume; low privilege sufficient via user-space mount delegation; no user interaction; full kernel memory impact possible from bounds-check bypass.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 12:25 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:25 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 11:23 NVD

8.4 (HIGH) 7.8 (HIGH)

CVE Published

May 20, 2024 - 10:15 cve.org

HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bcachefs: Check for journal entries overruning end of sb clean section

Fix a missing bounds check in superblock validation.

Note that we don't yet have repair code for this case - repair code for individual items is generally low priority, since the whole superblock is checksummed, validated prior to write, and we have backups.

AnalysisAI

Missing bounds validation in the bcachefs filesystem subsystem of the Linux kernel allows a local attacker with low privileges to trigger kernel memory corruption by mounting a crafted bcachefs volume with malformed journal entries in the superblock clean section. Affected versions span the Linux kernel up through 6.9-rc5. No public exploit code has been identified and EPSS sits at 0.23% (14th percentile), indicating low exploitation probability despite the high CVSS score; no active exploitation has been reported via CISA KEV.

Technical ContextAI

bcachefs is a copy-on-write filesystem merged into the Linux kernel mainline in 6.7. Its superblock contains a 'clean section' that stores journal entries describing the last clean unmount state. During superblock validation, the kernel iterates over these embedded journal entries; the missing bounds check means a maliciously crafted superblock can describe journal entries that extend beyond the end of the clean section buffer. CWE-400 (Uncontrolled Resource Consumption) is assigned by NVD, though the root cause is better characterized as a missing input-validation guard (CWE-125/CWE-1285) - an over-read or walk past a buffer boundary during parsing of untrusted on-disk data. CPE data confirms affected products are cpe:2.3:o:linux:linux_kernel across the stable tree and 6.9-rc1 through 6.9-rc5.

RemediationAI

The upstream fix is available as commit fcdbc1d7a4b638e5d5668de461f320386f3002aa in the Linux stable tree (https://git.kernel.org/stable/c/fcdbc1d7a4b638e5d5668de461f320386f3002aa); an exact downstream stable release version is not confirmed from available input data - consult your distribution's security tracker (e.g., Ubuntu USN, RHEL RHSA, Debian DSA) for the patched kernel package version. As a compensating control where patching is not immediately possible, restrict unprivileged mounting of filesystems by disabling udisks automount for bcachefs volumes and setting the kernel parameter 'user_allow_other=0' in fuse.conf to reduce attack surface. Note that bcachefs is a relatively new filesystem and may not be enabled by default in all distributions, so verifying whether bcachefs kernel module is loaded (lsmod | grep bcachefs) can inform exposure.