{"cve":"CVE-2024-50210","nvd":{"published":"2024-11-08T06:15:17.350","modified":"2026-10-15T01:19:10.513","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nposix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()\n\nIf get_clock_desc() succeeds, it calls fget() for the clockid's fd,\nand get the clk->rwsem read lock, so the error path should release\nthe lock to make the lock balance and fput the clockid's fd to make\nthe refcount balance and release the fd related resource.\n\nHowever the below commit left the error path locked behind resulting in\nunbalanced locking. Check timespec64_valid_strict() before\nget_clock_desc() to fix it, because the \"ts\" is not changed\nafter that.\n\n[pabeni@redhat.com: fixed commit message typo]","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-667"],"references":["https://git.kernel.org/stable/c/1ba33b327c3f88a7baee598979d73ab5b44d41cc","https://git.kernel.org/stable/c/5f063bbf1ee6b01611c016b54e050a41506eb794","https://git.kernel.org/stable/c/6e62807c7fbb3c758d233018caf94dfea9c65dbd","https://git.kernel.org/stable/c/a8219446b95a859488feaade674d13f9efacfa32","https://git.kernel.org/stable/c/b27330128eca25179637c1816d5a72d6cc408c66"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:57:07.693694550+00:00"},"epss":{"cve":"CVE-2024-50210","score":0.0017,"percentile":0.0636,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}