---
id: CVE-2024-49994
title: "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix integer overflow in BLKSECDISCARD\n\nI independently rediscovered\n\n\tcommit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155\n\tblock: fix overflow in blk_ioctl_discard()…"
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix integer overflow in BLKSECDISCARD\n\nI independently rediscovered\n\n\tcommit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155\n\tblock: fix overflow in blk_ioctl_discard()…"
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-190
vendor: linux
product: linux_kernel
affected:
  - linux_kernel < 6.10.14
  - 'linux_kernel >= 6.11, < 6.11.3'
patched:
  - linux_kernel 6.11.3
published: '2024-10-21'
updated: '2026-07-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-49994'
references:
  - url: 'https://git.kernel.org/stable/c/0842ddd83939eb4db940b9af7d39e79722bc41aa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/697ba0b6ec4ae04afb67d3911799b5e2043b4455'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6c9915fa9410cbb9bd75ee283c03120046c56d3d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8476f8428e8b48fd7a0e4258fa2a96a8f4468239'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a99bacb35c1416355eef957560e8fcac3a665549'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49994.json
  - url: 'https://access.redhat.com/security/cve/CVE-2024-49994'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2320554'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2024-49994'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-49994'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2024102138-CVE-2024-49994-de99@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2025:6966'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00241
epssPercentile: 0.13567
ingestedAt: '2026-07-14T13:36:54.596Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-10-22T13:30:51.719818Z'
scores:
  nvd: 5.5
  vendor: 4.4
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

block: fix integer overflow in BLKSECDISCARD

I independently rediscovered

	commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155
	block: fix overflow in blk_ioctl_discard()

but for secure erase.

Same problem:

	uint64_t r[2] = {512, 18446744073709551104ULL};
	ioctl(fd, BLKSECDISCARD, r);

will enter near infinite loop inside blkdev_issue_secure_erase():

	a.out: attempt to access beyond end of device
	loop0: rw=5, sector=3399043073, nr_sectors = 1024 limit=2048
	bio_check_eod: 3286214 callbacks suppressed

## Affected

- `linux_kernel < 6.10.14`
- `linux_kernel >= 6.11, < 6.11.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.11.3`

## Vendor advisories

- **RHSA-2025:6966** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2025-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:6966)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-09-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49994.json)