VYPR
← All advisories
High severity7.8NVD Advisory· Published Nov 9, 2024· Updated May 12, 2026

CVE-2024-50246

CVE-2024-50246

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Add rough attr alloc_size check

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing allocation size check in the Linux kernel's NTFS3 driver can lead to memory corruption, potentially allowing local privilege escalation.

The vulnerability resides in the NTFS3 filesystem driver (fs/ntfs3) in the Linux kernel. The driver lacked a proper check on the allocation size of attributes when parsing NTFS metadata. This missing validation could allow a malformed NTFS image to trigger an out-of-bounds memory access [1].

Exploitation requires the ability to mount a crafted NTFS filesystem. An attacker with local access and the capability to mount a filesystem (e.g., via a USB drive or loop device) could trigger the vulnerability. No special privileges beyond the ability to mount are needed.

Successful exploitation could lead to memory corruption, potentially resulting in a denial of service (system crash) or local privilege escalation if the corruption is controlled. The CVSS score of 7.8 reflects the high impact on confidentiality, integrity, and availability.

The fix was applied in the Linux kernel stable tree via commits [2], [3], [4]. Users should update to a kernel version containing these patches. Siemens has also acknowledged the issue in their advisory [1] for affected SIMATIC S7-1500 CPUs, indicating that the vulnerability impacts their products.

References
  1. SSA-082556
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

76

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.