CVE-2024-26773 (GCVE-0-2024-26773)
Vulnerability from cvelistv5
Published
2024-04-03 17:00
Modified
2026-08-05 11:27
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid allocating blocks from a group with a corrupted block bitmap in the following concurrency and making the situation worse. ext4_mb_regular_allocator ext4_lock_group(sb, group) ext4_mb_good_group // check if the group bbitmap is corrupted ext4_mb_complex_scan_group // Scan group gets ac_b_ex but doesn't use it ext4_unlock_group(sb, group) ext4_mark_group_bitmap_corrupted(group) // The block bitmap was corrupted during // the group unlock gap. ext4_mb_try_best_found ext4_lock_group(ac->ac_sb, group) ext4_mb_use_best_found mb_mark_used // Allocating blocks in block bitmap corrupted group
References
Impacted products
Vendor Product Version
Linux Linux Version: 163a203ddb36c36d4a1c942aececda0cc8d06aa7
Version: 163a203ddb36c36d4a1c942aececda0cc8d06aa7
Version: 163a203ddb36c36d4a1c942aececda0cc8d06aa7
Version: 163a203ddb36c36d4a1c942aececda0cc8d06aa7
Version: 163a203ddb36c36d4a1c942aececda0cc8d06aa7
Version: 163a203ddb36c36d4a1c942aececda0cc8d06aa7
Version: 163a203ddb36c36d4a1c942aececda0cc8d06aa7
Version: 163a203ddb36c36d4a1c942aececda0cc8d06aa7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26773",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-03T18:50:26.209110Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:10.181Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.512Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/mballoc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21f8cfe79f776287459343e9cfa6055af61328ea",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "260fc96283c0f594de18a1b045faf6d8fb42874d",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "927794a02169778c9c2e7b25c768ab3ea8c1dc03",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "4c21fa60a6f4606f6214a38f50612b17b2f738f5",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "f97e75fa4e12b0aa0224e83fcbda8853ac2adf36",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "0184747b552d6b5a14db3b7fcc3b792ce64dedd1",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "a2576ae9a35c078e488f2c573e9e6821d651fbbe",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "4530b3660d396a646aad91a787b6ab37cf604b53",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/mballoc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.308",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.308",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.270",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.211",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.150",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.80",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\n\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\next4_mb_try_best_found() to avoid allocating blocks from a group with a\ncorrupted block bitmap in the following concurrency and making the\nsituation worse.\n\next4_mb_regular_allocator\n  ext4_lock_group(sb, group)\n  ext4_mb_good_group\n   // check if the group bbitmap is corrupted\n  ext4_mb_complex_scan_group\n   // Scan group gets ac_b_ex but doesn\u0027t use it\n  ext4_unlock_group(sb, group)\n                           ext4_mark_group_bitmap_corrupted(group)\n                           // The block bitmap was corrupted during\n                           // the group unlock gap.\n  ext4_mb_try_best_found\n    ext4_lock_group(ac-\u003eac_sb, group)\n    ext4_mb_use_best_found\n      mb_mark_used\n      // Allocating blocks in block bitmap corrupted group"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable allocator is reached only through local filesystem operations (`write()`, `fallocate()`, truncate/extend) on a mounted ext4 filesystem via `ext4_mb_new_blocks()` \u2192 `ext4_mb_regular_allocator()`. No network protocol handler parses data that reaches this code directly.\nAC:L - The attacker drives both sides of the window \u2014 many concurrent writer threads on the same block group both create the allocation pressure that forces the `ac_b_ex.fe_len \u003e 0 \u0026\u0026 !AC_STATUS_FOUND` fallback into `ext4_mb_try_best_found()` and supply the concurrent free/scan that flags the group corrupt \u2014 and the same-thread path (corruption detected inside `ext4_mb_complex_scan_group()`, `break`, then the fallback allocation) needs no race at all; the sequence can be retried indefinitely at no cost.\nPR:L - Only an unprivileged local account with write access to any ext4 mount (`/tmp`, `/home`, an app data partition on Android/embedded) is needed; no capability, mount privilege, or fs-specific permission is consulted on the allocation path.\nUI:N - Once a group is flagged corrupt \u2014 by media aging on eMMC/flash in embedded and automotive deployments, by a prior detected double-free, or by the free-count mismatch the attacker\u0027s own concurrent allocation traffic provokes \u2014 exploitation is entirely the attacker\u0027s own syscalls, with no victim mount or file access required.\nS:U - The damaged resources are the ext4 block bitmap, buddy state, and file data, all managed by the same kernel security authority as the vulnerable code; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Allocating from a group whose bitmap is known-inconsistent hands the attacker\u0027s file blocks that are still referenced by other inodes \u2014 the double-free detector\u0027s case is exactly \"this block is still owned by another file\" \u2014 so simply reading the attacker\u0027s own new file discloses other users\u0027 and system files\u0027 on-disk contents.\nI:H - The same double allocation lets attacker-controlled writes land on blocks belonging to other users\u0027 files and, where the bitmap accounting is wrong for metadata blocks, on ext4 metadata (inode table, bitmaps), corrupting foreign data and inode fields in a way that is leverageable for privilege escalation.\nA:H - Operating on the inconsistent buddy triggers `BUG_ON(ord \u003c= 0)` / `BUG_ON((start \u003e\u003e ord) \u003e= max)` in `mb_mark_used()`, `bb_free`/`bb_fragments` underflow feeding the divide-by-zero in `mb_update_avg_fragment_size()`, and `ext4_grp_locked_error()`, which forces the filesystem read-only by default and panics the kernel with `errors=panic`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:10.867Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d"
        },
        {
          "url": "https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36"
        },
        {
          "url": "https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53"
        }
      ],
      "title": "ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26773",
    "datePublished": "2024-04-03T17:00:59.757Z",
    "dateReserved": "2024-02-19T14:20:24.176Z",
    "dateUpdated": "2026-08-05T11:27:10.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.512Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26773\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-03T18:50:26.209110Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:21.835Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable allocator is reached only through local filesystem operations (`write()`, `fallocate()`, truncate/extend) on a mounted ext4 filesystem via `ext4_mb_new_blocks()` \\u2192 `ext4_mb_regular_allocator()`. No network protocol handler parses data that reaches this code directly.\\nAC:L - The attacker drives both sides of the window \\u2014 many concurrent writer threads on the same block group both create the allocation pressure that forces the `ac_b_ex.fe_len \u003e 0 \u0026\u0026 !AC_STATUS_FOUND` fallback into `ext4_mb_try_best_found()` and supply the concurrent free/scan that flags the group corrupt \\u2014 and the same-thread path (corruption detected inside `ext4_mb_complex_scan_group()`, `break`, then the fallback allocation) needs no race at all; the sequence can be retried indefinitely at no cost.\\nPR:L - Only an unprivileged local account with write access to any ext4 mount (`/tmp`, `/home`, an app data partition on Android/embedded) is needed; no capability, mount privilege, or fs-specific permission is consulted on the allocation path.\\nUI:N - Once a group is flagged corrupt \\u2014 by media aging on eMMC/flash in embedded and automotive deployments, by a prior detected double-free, or by the free-count mismatch the attacker\u0027s own concurrent allocation traffic provokes \\u2014 exploitation is entirely the attacker\u0027s own syscalls, with no victim mount or file access required.\\nS:U - The damaged resources are the ext4 block bitmap, buddy state, and file data, all managed by the same kernel security authority as the vulnerable code; no hypervisor, IOMMU, or sandbox boundary is crossed.\\nC:H - Allocating from a group whose bitmap is known-inconsistent hands the attacker\u0027s file blocks that are still referenced by other inodes \\u2014 the double-free detector\u0027s case is exactly \\\"this block is still owned by another file\\\" \\u2014 so simply reading the attacker\u0027s own new file discloses other users\u0027 and system files\u0027 on-disk contents.\\nI:H - The same double allocation lets attacker-controlled writes land on blocks belonging to other users\u0027 files and, where the bitmap accounting is wrong for metadata blocks, on ext4 metadata (inode table, bitmaps), corrupting foreign data and inode fields in a way that is leverageable for privilege escalation.\\nA:H - Operating on the inconsistent buddy triggers `BUG_ON(ord \u003c= 0)` / `BUG_ON((start \u003e\u003e ord) \u003e= max)` in `mb_mark_used()`, `bb_free`/`bb_fragments` underflow feeding the divide-by-zero in `mb_update_avg_fragment_size()`, and `ext4_grp_locked_error()`, which forces the filesystem read-only by default and panics the kernel with `errors=panic`.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"21f8cfe79f776287459343e9cfa6055af61328ea\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"260fc96283c0f594de18a1b045faf6d8fb42874d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"927794a02169778c9c2e7b25c768ab3ea8c1dc03\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"4c21fa60a6f4606f6214a38f50612b17b2f738f5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"f97e75fa4e12b0aa0224e83fcbda8853ac2adf36\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"0184747b552d6b5a14db3b7fcc3b792ce64dedd1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"a2576ae9a35c078e488f2c573e9e6821d651fbbe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"4530b3660d396a646aad91a787b6ab37cf604b53\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ext4/mballoc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.308\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.270\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.211\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.150\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.80\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ext4/mballoc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea\"}, {\"url\": \"https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d\"}, {\"url\": \"https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03\"}, {\"url\": \"https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5\"}, {\"url\": \"https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36\"}, {\"url\": \"https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1\"}, {\"url\": \"https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe\"}, {\"url\": \"https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\\n\\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\\next4_mb_try_best_found() to avoid allocating blocks from a group with a\\ncorrupted block bitmap in the following concurrency and making the\\nsituation worse.\\n\\next4_mb_regular_allocator\\n  ext4_lock_group(sb, group)\\n  ext4_mb_good_group\\n   // check if the group bbitmap is corrupted\\n  ext4_mb_complex_scan_group\\n   // Scan group gets ac_b_ex but doesn\u0027t use it\\n  ext4_unlock_group(sb, group)\\n                           ext4_mark_group_bitmap_corrupted(group)\\n                           // The block bitmap was corrupted during\\n                           // the group unlock gap.\\n  ext4_mb_try_best_found\\n    ext4_lock_group(ac-\u003eac_sb, group)\\n    ext4_mb_use_best_found\\n      mb_mark_used\\n      // Allocating blocks in block bitmap corrupted group\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.308\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.270\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.211\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.150\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.80\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.19\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.7\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"3.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:10.867Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26773\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:10.867Z\", \"dateReserved\": \"2024-02-19T14:20:24.176Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T17:00:59.757Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.