CVE-2024-26704 — Double Free in Linux
Severity
7.8HIGHNVD
OSV6.5OSV5.5
EPSS
0.0%
top 98.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 3
Latest updateAug 14
Description
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix double-free of blocks due to wrong extents moved_len
In ext4_move_extents(), moved_len is only updated when all moves are
successfully executed, and only discards orig_inode and donor_inode
preallocations when moved_len is not zero. When the loop fails to exit
after successfully moving some extents, moved_len is not updated and
remains at 0, so it does not discard the preallocations.
If the moved extents overlap wit…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages5 packages
▶CVEListV5linux/linuxfcf6b1b729bcd23f2b49a84fb33ffbb44712ee6a — b4fbb89d722cbb16beaaea234b7230faaaf68c71+8
Also affects: Debian Linux 10.0
Patches
🔴Vulnerability Details
15📋Vendor Advisories
16💬Community
1Bugzilla
▶