CVE-2024-14027
published 2026-03-09CVE-2024-14027: In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
11.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
fs/xattr: missing fdput() in fremovexattr error path
In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a
file reference but returns early without calling fdput() when
strncpy_from_user() fails on the name argument. In multi-threaded processes
where fdget() takes the slow path, this permanently leaks one
file reference per call, pinning the struct file and associated kernel
objects in memory. An unprivileged local user can exploit this to cause
kernel memory exhaustion. The issue was inadvertently fixed by commit
a71874379ec8 ("xattr: switch to CLASS(fd)").
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.16.3-1 (forky) | linux 6.16.3-1 (forky) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 6.10.10 < 6.11 | 6.11 |
| linux | linux | >= 6.6.51 < 6.6.133 | 6.6.133 |
| linux | linux | >= c03185f4a23e7f89d84c9981091770e876e64480 < 9a3a2ae5efbbcaed37551218abed94e23c537157 | 9a3a2ae5efbbcaed37551218abed94e23c537157 |
| linux | linux | >= c3a5e3e872f3688ae0dc57bb78ca633921d96a91 < d151b94967c8247005435b63fc60f8f4baa320da | d151b94967c8247005435b63fc60f8f4baa320da |
| linux | linux | >= c3a5e3e872f3688ae0dc57bb78ca633921d96a91 < a71874379ec8c6e788a61d71b3ad014a8d9a5c08 | a71874379ec8c6e788a61d71b3ad014a8d9a5c08 |
| linux | linux_kernel | >= 0 < 6.16.3-1 | 6.16.3-1 |
| linux | linux_kernel | >= 6.10.10 < 6.12.77 | 6.12.77 |
| linux | linux_kernel | >= 6.11.0 < 6.12.77 | 6.12.77 |
| linux | linux_kernel | >= 6.6.51 < 6.6.133 | 6.6.133 |
| msrc | azl3_kernel_6.6.126.1-1_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_msrc5.5MEDIUM
vendor_redhat5.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for Desktop: CVE-2026-14027
vendor_chrome·2026-06-30
CVE-2026-14027 [LOW] Stable Channel Update for Desktop: CVE-2026-14027
Stable Channel Update for Desktop
CVE-2026-14027: Use after free in SignIn. Reported by Sven Dysthe (@svn-dys) on 2024-08-21 [TBD][ 401816601 ] Low CVE-2026-14028: Incorrect security UI in Chrome for iOS
Reported by Ameen Basha M K on 2025-03-09 [TBD][ 488762971 ] Low CVE-2026-14030: Incorrect security UI in SplitView
Severity: low
Microsoft
xattr: switch to CLASS(fd)
vendor_msrc·2026-03-10·CVSS 5.5
CVE-2024-14027 [MEDIUM] xattr: switch to CLASS(fd)
xattr: switch to CLASS(fd)
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Red Hat
kernel: xattr: switch to CLASS(fd)
vendor_redhat·2026-03-09·CVSS 5.5
CVE-2024-14027 [LOW] kernel: xattr: switch to CLASS(fd)
kernel: xattr: switch to CLASS(fd)
In the Linux kernel, the following vulnerability has been resolved:
fs/xattr: missing fdput() in fremovexattr error path
In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a
file reference but returns early without calling fdput() when
strncpy_from_user() fails on the name argument. In multi-threaded processes
where fdget() takes the slow path, this permanently leaks one
file reference per call, pinning the struct file and associated kernel
objects in memory. An unprivileged local user can exploit this to cause
kernel memory exhaustion. The issue was inadvertently fixed by commit
a71874379ec8 ("xattr: switch to CLASS(fd)").
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) -
Debian
CVE-2024-14027: linux - In the Linux kernel, the following vulnerability has been resolved: fs/xattr: m...
vendor_debian·2024
CVE-2024-14027 [LOW] CVE-2024-14027: linux - In the Linux kernel, the following vulnerability has been resolved: fs/xattr: m...
In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a file reference but returns early without calling fdput() when strncpy_from_user() fails on the name argument. In multi-threaded processes where fdget() takes the slow path, this permanently leaks one file reference per call, pinning the struct file and associated kernel objects in memory. An unprivileged local user can exploit this to cause kernel memory exhaustion. The issue was inadvertently fixed by commit a71874379ec8 ("xattr: switch to CLASS(fd)").
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.16.3-1)
sid: resolved (fixed in 6.16.3-1)
trixie: open
VulDB
Linux Kernel xattr memory allocation (EUVD-2024-55470 / Nessus ID 318102)
vuldb·2026-06-26·CVSS 5.5
CVE-2024-14027 [MEDIUM] Linux Kernel xattr memory allocation (EUVD-2024-55470 / Nessus ID 318102)
A vulnerability identified as critical has been detected in Linux Kernel. This affects an unknown function of the component xattr. The manipulation leads to uncontrolled memory allocation.
This vulnerability is documented as CVE-2024-14027. The attack needs to be performed locally. There is not any exploit available.
It is suggested to install a patch to address this issue.
OSV
xattr: switch to CLASS(fd)
osv·2026-03-09
CVE-2024-14027 xattr: switch to CLASS(fd)
xattr: switch to CLASS(fd)
In the Linux kernel, the following vulnerability has been resolved:
fs/xattr: missing fdput() in fremovexattr error path
In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a
file reference but returns early without calling fdput() when
strncpy_from_user() fails on the name argument. In multi-threaded processes
where fdget() takes the slow path, this permanently leaks one
file reference per call, pinning the struct file and associated kernel
objects in memory. An unprivileged local user can exploit this to cause
kernel memory exhaustion. The issue was inadvertently fixed by commit
a71874379ec8 ("xattr: switch to CLASS(fd)").
GHSA
GHSA-h9jc-64qv-h9cg: In the Linux kernel, the following vulnerability has been resolved:
fs/xattr: missing fdput() in fremovexattr error path
In the Linux kernel, the fr
ghsa_unreviewed·2026-03-09
CVE-2024-14027 GHSA-h9jc-64qv-h9cg: In the Linux kernel, the following vulnerability has been resolved:
fs/xattr: missing fdput() in fremovexattr error path
In the Linux kernel, the fr
In the Linux kernel, the following vulnerability has been resolved:
fs/xattr: missing fdput() in fremovexattr error path
In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a
file reference but returns early without calling fdput() when
strncpy_from_user() fails on the name argument. In multi-threaded processes
where fdget() takes the slow path, this permanently leaks one
file reference per call, pinning the struct file and associated kernel
objects in memory. An unprivileged local user can exploit this to cause
kernel memory exhaustion. The issue was inadvertently fixed by commit
a71874379ec8 ("xattr: switch to CLASS(fd)").
OSV
CVE-2024-14027: In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the frem
osv·2026-03-09
CVE-2024-14027 CVE-2024-14027: In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the frem
In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a file reference but returns early without calling fdput() when strncpy_from_user() fails on the name argument. In multi-threaded processes where fdget() takes the slow path, this permanently leaks one file reference per call, pinning the struct file and associated kernel objects in memory. An unprivileged local user can exploit this to cause kernel memory exhaustion. The issue was inadvertently fixed by commit a71874379ec8 ("xattr: switch to CLASS(fd)").
No detection rules found.
No public exploits indexed.
Wiz
CVE-2024-14027 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2024-14027 CVE-2024-14027 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2024-14027 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
fs/xattr: missing fdput() in fremovexattr error path
In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a
file reference but returns early without calling fdput() when
strncpy_from_user() fails on the name argument. In multi-threaded processes
where fdget() takes the slow path, this permanently leaks one
file reference per call, pinning the struct file and associated kernel
objects in memory. An unprivileged local user can exploit this to cause
kernel memory exhaustion. The issue was inadvertently fixed by commit
a71874379ec8 ("xattr: switch to CLASS(fd)").
Source : NVD
## 5.5
Score
Published March 9, 2026
Severity MEDIU
Bugzilla
CVE-2024-14027 kernel: xattr: switch to CLASS(fd)
bugzilla·2026-03-09·CVSS 5.5
CVE-2024-14027 [MEDIUM] CVE-2024-14027 kernel: xattr: switch to CLASS(fd)
CVE-2024-14027 kernel: xattr: switch to CLASS(fd)
In the Linux kernel, the following vulnerability has been resolved:
fs/xattr: missing fdput() in fremovexattr error path
In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a
file reference but returns early without calling fdput() when
strncpy_from_user() fails on the name argument. In multi-threaded processes
where fdget() takes the slow path, this permanently leaks one
file reference per call, pinning the struct file and associated kernel
objects in memory. An unprivileged local user can exploit this to cause
kernel memory exhaustion. The issue was inadvertently fixed by commit
a71874379ec8 ("xattr: switch to CLASS(fd)").
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026030917-CVE-20
2026-03-09
Published