{"id":"CVE-2024-50014","title":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix access to uninitialised lock in fc replay path\n\nThe following kernel trace can be triggered with fstest generic/629 when\nexecuted against a filesystem with fa…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix access to uninitialised lock in fc replay path\n\nThe following kernel trace can be triggered with fstest generic/629 when\nexecuted against a filesystem with fa…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-908"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel < 6.10.14","linux_kernel >= 6.11, < 6.11.3"],"patched":["linux_kernel 6.11.3"],"published":"2024-10-21","updated":"2026-07-14","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-50014","references":[{"url":"https://git.kernel.org/stable/c/23dfdb56581ad92a9967bcd720c8c23356af74c1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e35f560daebe40264c95e9a1ab03110d4997df6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b002031d585a14eed511117dda8c6452a804d508","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d157fc20ca5239fd56965a5a8aa1a0e25919891a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50014.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-50014"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2320481"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-50014"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50014"},{"url":"https://lore.kernel.org/linux-cve-announce/2024102110-CVE-2024-50014-d684@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2025:6966"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00224,"epssPercentile":0.11591,"ingestedAt":"2026-07-14T13:36:54.635Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-10-22T13:28:16.018937Z"},"slug":"CVE-2024-50014","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: fix access to uninitialised lock in fc replay path\n\nThe following kernel trace can be triggered with fstest generic/629 when\nexecuted against a filesystem with fast-commit feature enabled:\n\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nyou didn't initialize this object before use?\nturning off the locking correctness validator.\nCPU: 0 PID: 866 Comm: mount Not tainted 6.10.0+ #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0x90\n register_lock_class+0x759/0x7d0\n __lock_acquire+0x85/0x2630\n ? __find_get_block+0xb4/0x380\n lock_acquire+0xd1/0x2d0\n ? __ext4_journal_get_write_access+0xd5/0x160\n _raw_spin_lock+0x33/0x40\n ? __ext4_journal_get_write_access+0xd5/0x160\n __ext4_journal_get_write_access+0xd5/0x160\n ext4_reserve_inode_write+0x61/0xb0\n __ext4_mark_inode_dirty+0x79/0x270\n ? ext4_ext_replay_set_iblocks+0x2f8/0x450\n ext4_ext_replay_set_iblocks+0x330/0x450\n ext4_fc_replay+0x14c8/0x1540\n ? jread+0x88/0x2e0\n ? rcu_is_watching+0x11/0x40\n do_one_pass+0x447/0xd00\n jbd2_journal_recover+0x139/0x1b0\n jbd2_journal_load+0x96/0x390\n ext4_load_and_init_journal+0x253/0xd40\n ext4_fill_super+0x2cc6/0x3180\n...\n\nIn the replay path there's an attempt to lock sbi->s_bdev_wb_lock in\nfunction ext4_check_bdev_write_error().  Unfortunately, at this point this\nspinlock has not been initialized yet.  Moving it's initialization to an\nearlier point in __ext4_fill_super() fixes this splat.\n\n## Affected\n\n- `linux_kernel < 6.10.14`\n- `linux_kernel >= 6.11, < 6.11.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.11.3`\n\n## Vendor advisories\n\n- **RHSA-2025:6966** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:6966)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-09-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50014.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}