cbcvebase.
CVE-2024-26685
published 2024-04-03

CVE-2024-26685: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in end_buffer_async_write According to a syzbot report…

PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.4th percentile
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in end_buffer_async_write According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition of the buffer async_write flag and cause a BUG_ON failure when using nilfs2. Nilfs2 itself does not use end_buffer_async_write(). But, the async_write flag is now used as a marker by commit 7f42ec394156 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks") as a means of resolving double list insertion of dirty blocks in nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the resulting crash. This modification is safe as long as it is used for file data and b-tree node blocks where the page caches are independent. However, it was irrelevant and redundant to also introduce async_write for segment summary and super root blocks that share buffers with the backing device. This led to the possibility that the BUG_ON check in end_buffer_async_write would fail as described above, if independent writebacks of the backing device occurred in parallel. The use of async_write for segment summary buffers has already been removed in a previous change. Fix this issue by removing the manipulation of the async_write flag for the remaining super root block buffer.

Affected

38 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.82-1 (bookworm)linux 6.1.82-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux>= 3.10.16 < 3.113.11
linuxlinux>= 3.11.5 < 3.123.12
linuxlinux>= 3.2.52 < 3.33.3
linuxlinux>= 3.4.83 < 3.53.5
linuxlinux>= 7f42ec3941560f0902fe3671e36f2c20ffd3af0a < c4a09fdac625e64abe478dcf88bfa20406616928c4a09fdac625e64abe478dcf88bfa20406616928
linuxlinux>= 7f42ec3941560f0902fe3671e36f2c20ffd3af0a < d31c8721e816eff5ca6573cc487754f357c093cdd31c8721e816eff5ca6573cc487754f357c093cd
linuxlinux>= 7f42ec3941560f0902fe3671e36f2c20ffd3af0a < f3e4963566f58726d3265a727116a42b591f6596f3e4963566f58726d3265a727116a42b591f6596
linuxlinux>= 7f42ec3941560f0902fe3671e36f2c20ffd3af0a < 8fa90634ec3e9cc50f42dd605eec60f2d146ced88fa90634ec3e9cc50f42dd605eec60f2d146ced8
linuxlinux>= 7f42ec3941560f0902fe3671e36f2c20ffd3af0a < 6589f0f72f8edd1fa11adce4eedbd3615f2e78ab6589f0f72f8edd1fa11adce4eedbd3615f2e78ab
linuxlinux>= 7f42ec3941560f0902fe3671e36f2c20ffd3af0a < 2c3bdba00283a6c7a5b19481a59a730f460638032c3bdba00283a6c7a5b19481a59a730f46063803
linuxlinux>= 7f42ec3941560f0902fe3671e36f2c20ffd3af0a < 626daab3811b772086aef1bf8eed3ffe6f523eff626daab3811b772086aef1bf8eed3ffe6f523eff
linuxlinux>= 7f42ec3941560f0902fe3671e36f2c20ffd3af0a < 5bc09b397cbf1221f8a8aacb1152650c9195b02b5bc09b397cbf1221f8a8aacb1152650c9195b02b
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.216-15.10.216-1
linuxlinux_kernel>= 0 < 6.1.82-16.1.82-1
linuxlinux_kernel>= 0 < 6.7.7-16.7.7-1
linuxlinux_kernel>= 0 < 6.7.7-16.7.7-1
linuxlinux_kernel>= 0 < 5.4.0-181.2015.4.0-181.201

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.