CVE-2024-0841 is a medium severity (CVSS 6.6) NULL pointer dereference in the hugetlbfs_fill_super function of the Linux kernel's HugeTLB filesystem code. A local user may crash the system or potentially escalate privileges. Install your distribution's kernel update and reboot.
What's affected
The Linux kernel, in the hugetlbfs_fill_super function of HugeTLB pages support. The CPE data lists several kernel ranges and Red Hat Enterprise Linux 8.0. The references include Red Hat errata RHSA-2024:2394, RHSA-2024:2950 and RHSA-2024:3138.
The record says a local user may crash the system or potentially escalate privileges.
The record classifies the weakness as CWE-476 (NULL pointer dereference). NVD scores it 6.6 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H.
How to check if you're exposed
Run uname -r on each host and note the kernel build. Then compare it with your distribution's security notes for this CVE, because distributions backport fixes and keep the original version string. A kernel that looks old can already carry the patch, and a kernel that looks new can lack it.
uname -r
# Red Hat family: list advisories that mention the CVE
rpm -q --changelog kernel | grep CVE-2024-0841
If the grep prints a line, the installed kernel package lists a change for this CVE. No output means you should read the vendor advisory before assuming anything either way. Container hosts matter most here, since every container shares the host kernel.
What to do now
- Read the Red Hat errata and your distribution tracker for your release.
- Install the fixed kernel package and reboot.
- Verify the running kernel with uname -r.
- Prioritise multi user hosts and container hosts.
Why it matters
A NULL pointer dereference (CWE-476) happens when code uses a pointer that was never set. In the kernel that usually means a crash, which is a denial of service on the whole host. The record also says privilege escalation is possible in some conditions, though crashes are the common result.
The local requirement limits exposure to systems where untrusted users or workloads run.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Try it yourself
Kernel patches live on the host, but images carry their own packages. This demo shows what a container image scan reports.
Click through it at your own pace, or open it full screen.
Quick check
Will rebooting be required?
Yes, unless you use a live patching service that covers this fix. Check with your vendor.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- Safeguard Gold entry for CVE-2024-0841
Last reviewed: 19 October 2026.
