CVE-2024-0775 is a medium severity (CVSS 6.7) use after free in the Linux kernel ext4 remount code, in the function __ext4_remount in fs/ext4/super.c. A local user can trigger an information leak. Install the kernel update from your distribution, since fixes are backported under the original version number.
What's affected
The Linux kernel, in the ext4 filesystem code (function __ext4_remount in fs/ext4/super.c). The CPE data includes a 6.4 release candidate and Red Hat Enterprise Linux 9.0. The record does not give a clean fixed version range, and the description comes from Red Hat's advisory text.
The record says the flaw lets a local user cause an information leak while freeing the old quota file names before a possible failure, which leads to the use after free. A stable tree commit is among the references.
The record classifies the weakness as CWE-416 (use after free). NVD scores it 6.7 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Run uname -r on each host and note the kernel build. Then compare it with your distribution's security notes for this CVE, because distributions backport fixes and keep the original version string. A kernel that looks old can already carry the patch, and a kernel that looks new can lack it.
uname -r
# Red Hat family: list advisories that mention the CVE
rpm -q --changelog kernel | grep CVE-2024-0775
If the grep prints a line, the installed kernel package lists a change for this CVE. No output means you should read the vendor advisory before assuming anything either way. Container hosts matter most here, since every container shares the host kernel.
What to do now
- Check your distribution's security tracker for CVE-2024-0775 and note the fixed kernel package for your release.
- Install the updated kernel package and reboot, since a kernel fix does not take effect until the new kernel is running.
- Confirm the running kernel with uname -r after the reboot, and compare with the package version.
- For container hosts and shared build machines, prioritise patching, as local users there include every workload that runs on the host.
Why it matters
A use after free (CWE-416) means memory is used after it has been released. Here the ext4 remount path frees old quota file names before a step that can fail, and later code may touch the freed data. The record describes the outcome as an information leak.
The attacker must already be running code locally, which is why the score sits in the medium range. Local bugs matter most on multi tenant machines, so patch order should follow that.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Try it yourself
Kernel issues live on the host, but your container base images carry their own vulnerable packages. This demo shows how an image scan lists what a container image contains.
Click through it at your own pace, or open it full screen.
Quick check
Does my container need a kernel patch?
No. Containers use the host kernel, so patch the host. Image updates help with userland packages only.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
