CVE-2024-58092: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-58092 is a vulnerability in the Linux kernel related to legacy client tracking initialization in the NFSD (Network File System Daemon) component. The vulnerability was disclosed on April 16, 2025, affecting the Linux kernel's NFS server implementation (NVD).

The vulnerability stems from a double initialization issue in the NFSD component where nfsd4_legacy_tracking_ops->init() is called twice during the check_for_legacy_methods() function execution. The second initialization triggers a BUG_ON() condition in nfsd4_init_recdir(). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (Red Hat).

The vulnerability primarily affects system availability, with no direct impact on confidentiality or integrity. When exploited, it can trigger a kernel bug condition that could lead to system instability or denial of service (Red Hat).

The vulnerability requires local access with low attack complexity and low privileges to exploit. No user interaction is needed for exploitation (Red Hat).

The vulnerability has been fixed in various Linux distributions. Debian has marked it as fixed in multiple releases including bullseye (5.10.234-1), bookworm (6.1.133-1), trixie (6.12.22-1), and sid (6.12.25-1). Red Hat Enterprise Linux 8 is not affected, while for RHEL 9, the fix is currently deferred (Debian, Red Hat).