cbcvebase.
CVE-2024-57923
published 2025-01-19

CVE-2024-57923: In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path Since the input data…

PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
11.2th percentile
In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path Since the input data length passed to zlib_compress_folios() can be arbitrary, always setting strm.avail_in to a multiple of PAGE_SIZE may cause read-in bytes to exceed the input range. Currently this triggers an assert in btrfs_compress_folios() on the debug kernel (see below). Fix strm.avail_in calculation for S390 hardware acceleration path. assertion failed: *total_in 0000021761df6538: 0707 bcr 0,%r7 0000021761df653a: 0707 bcr 0,%r7 0000021761df653c: 0707 bcr 0,%r7 0000021761df653e: 0707 bcr 0,%r7 0000021761df6540: c004004bb7ec brcl 0,000002176276d518 Call Trace: [] btrfs_compress_folios+0x198/0x1a0 ([] btrfs_compress_folios+0x194/0x1a0) [] compress_file_range+0x3b8/0x6d0 [] btrfs_work_helper+0x10c/0x160 [] process_one_work+0x2b0/0x5d0 [] worker_thread+0x20e/0x3e0 [] kthread+0x15a/0x170 [] __ret_from_fork+0x3c/0x60 [] ret_from_fork+0xa/0x38 INFO: lockdep is turned off. Last Breaking-Event-Address: [] _printk+0x4c/0x58 Kernel panic - not syncing: Fatal exception: panic_on_oops

Affected

8 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.12.10-1 (forky)linux 6.12.10-1 (forky)
linuxlinux
linuxlinux>= fd1e75d0105d2289e24b6d63cee49e6f7952c8bf < 25adbb08aeadcff883ab801df99fd20fefbb6ca425adbb08aeadcff883ab801df99fd20fefbb6ca4
linuxlinux>= fd1e75d0105d2289e24b6d63cee49e6f7952c8bf < 0ee4736c003daded513de0ff112d4a1e9c85bbab0ee4736c003daded513de0ff112d4a1e9c85bbab
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.12.10-16.12.10-1
linuxlinux_kernel>= 0 < 6.12.10-16.12.10-1
linuxlinux_kernel>= 6.12 < 6.12.106.12.10

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.