PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-49903 Linux CVE debrief

CVE-2024-49903 is a use-after-free (UAF) vulnerability in the Linux kernel's JFS (Journaled File System) implementation, specifically within the `dbFreeBits` function in `fs/jfs/jfs_dmap.c`. The vulnerability stems from a race condition between two code paths—`dbUnmount` and `jfs_ioc_trim`—that concurrently access the `bmap` structure without proper synchronization. The fix introduces the `s_umount` lock to synchronize these paths and prevent the UAF condition. Siemens has assessed this vulnerability as **Misinformed** for affected industrial control system products, indicating the vulnerability does not apply to their specific product configurations or the risk is otherwise mitigated in their environment.

Vendor
Linux
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Linux kernel maintainers and users of JFS filesystems; operators of Siemens industrial networking equipment (RUGGEDCOM, SCALANCE families) should verify vendor impact assessment

Technical summary

The vulnerability exists in the JFS filesystem's disk map management code. The `dbFreeBits` function can access freed memory when a race condition occurs between filesystem unmount (`dbUnmount`) and the discard/trim ioctl (`jfs_ioc_trim`). Both paths manipulate the `bmap` structure without adequate locking. The kernel fix adds `s_umount` lock synchronization to prevent concurrent access. The syzbot-reported crash occurred in kernel 6.11.0-rc3 with KASAN enabled, demonstrating the UAF through a slab memory corruption detected during mutex lock operations.

Defensive priority

low

Recommended defensive actions

  • Verify Linux kernel version and apply upstream JFS patch if running affected kernel versions with JFS filesystem support
  • Review Siemens ProductCERT advisory SSA-355557 for specific product impact assessments
  • For Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, and SCALANCE XCM-/XRM-/XCH-/XRH-300 family products, confirm vendor assessment that vulnerability is 'Misinformed' for your deployment
  • Follow CISA ICS recommended practices for defense-in-depth strategies in industrial control environments
  • Monitor CISA ICS advisories for any updates to product impact assessments

Evidence notes

The vulnerability was originally reported by syzbot and resolved in the Linux kernel. The KASAN (Kernel Address Sanitizer) report shows a slab-use-after-free occurring in `__mutex_lock` when called from `dbFreeBits`, with the freed memory having been released by `dbUnmount` while `jfs_ioc_trim` was still accessing it. Siemens ProductCERT advisory SSA-355557 and CISA advisory ICSA-25-226-07 both track this CVE. The CISA advisory was initially published on 2025-08-12 and most recently updated on 2026-02-25 to reflect republication based on the Siemens advisory. The threat assessment of 'Misinformed' indicates Siemens has determined this vulnerability does not pose a practical risk to their listed products.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-49903 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-49903

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-49903 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-49903

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.