--- cve: "CVE-2024-26956" severity: "MEDIUM" cvss: 5.5 epss: "26%" vendor: "Linux" kev: false exploited: false published: "2024-05-01 06:15:11" tags: [cve, security, medium] source: tsecurity.de CVE-Dossier exported: "2026-09-08T13:57:45+02:00" --- # CVE-2024-26956 > 5.5 MEDIUM ## Beschreibung In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submit_bh_wbc()". This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one a separate patch. The first patch alone resolves the syzbot-reported bug, but I think both fixes should be sent to stable, so I've tagged them as such. This patch (of 2): Syzbot has reported a kernel bug in submit_bh_wbc() when writing file data to a nilfs2 file system whose metadata is corrupted. There are two flaws involved in this issue. The first flaw is that when nilfs_get_block() locates a data block using btree or direct mapping, if the disk address translation routine nilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata corruption, it can be passed back to nilfs_get_block(). This causes nilfs_get_block() to misidentify an existing block as non-existent, causing both data block lookup and insertion to fail inconsistently. The second flaw is that nilfs_get_block() returns a successful status in this inconsistent state. This causes the caller __block_write_begin_int() or others to request a read even though the buffer is not mapped, resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc() failing. This fixes the first issue by changing the return value to code -EINVAL when a conversion using DAT fails with code -ENOENT, avoiding the conflicting condition that leads to the kernel bug described above. Here, code -EINVAL indicates that metadata corruption was detected during the block lookup, which will be properly handled as a file system error and converted to -EIO when passing through the nilfs2 bmap layer. ## CVSS-Vektor ``` CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Lokal | good | | AC Komplexität | Gering | bad | | PR Privilegien | Gering | warn | | UI Interaktion | Keine | bad | | S Scope | Unverändert | good | | C Vertraulichkeit | Keine | good | | I Integrität | Keine | good | | A Verfügbarkeit | Hoch | bad | ## Patch verfügbar (OSV) - Kernel ≥ 4.19.312 - Kernel ≥ 5.4.274 - Kernel ≥ 5.10.215 - Kernel ≥ 5.15.154 - Kernel ≥ 6.1.84 - Kernel ≥ 6.6.24 - Kernel ≥ 6.7.12 - Kernel ≥ 6.8.3 ## Referenzen - - - - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2024-26956) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_