CVE-2024-46690: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-46690 affects the Linux kernel's Network File System daemon (nfsd) component. The vulnerability was discovered in the nfsd4deleggetattr_conflict function's handling of third-party leases. The issue was identified and patched in Linux kernel versions from 6.9 up to 6.10.8, as well as release candidates 6.11-rc1 through 6.11-rc5 (NVD).

The vulnerability stems from unsafe dereferencing of fl->c.flcowner without first confirming fl->fllmops is the expected manager. The nfsd4deleggetattrconflict() function tests fllmops but largely ignores the result and incorrectly assumes that flcowner is an nfs4delegation. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Kernel Patch).

The vulnerability could potentially allow an attacker to cause system instability or denial of service through improper handling of delegation attributes in the NFS server implementation (NVD).

The vulnerability has been patched in the Linux kernel. The fix restores the "!= &nfsdleasemng_ops" case to behave as it did before the change, removing any reference to a possible delegation. Users should upgrade to Linux kernel version 6.10.8 or later to address this vulnerability (Kernel Patch).