CVE-2024-39469 (GCVE-0-2024-39469)
Vulnerability from cvelistv5
Published
2024-06-25 14:28
Modified
2026-08-05 11:33
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page.
References
Impacted products
Vendor Product Version
Linux Linux Version: 2ba466d74ed74f073257f86e61519cb8f8f46184
Version: 2ba466d74ed74f073257f86e61519cb8f8f46184
Version: 2ba466d74ed74f073257f86e61519cb8f8f46184
Version: 2ba466d74ed74f073257f86e61519cb8f8f46184
Version: 2ba466d74ed74f073257f86e61519cb8f8f46184
Version: 2ba466d74ed74f073257f86e61519cb8f8f46184
Version: 2ba466d74ed74f073257f86e61519cb8f8f46184
Version: 2ba466d74ed74f073257f86e61519cb8f8f46184
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:56:03.781Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2ac8a2fe22bdde9eecce2a42cf5cab79333fb428"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/405b71f1251e5ae865f53bd27c45114e6c83bee3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c77ad608df6c091fe64ecb91f41ef7cb465587f1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/11a2edb70356a2202dcb7c9c189c8356ab4752cd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/129dcd3e7d036218db3f59c82d82004b9539ed82"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d18b05eda7fa77f02114f15b02c009f28ee42346"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/59f14875a96ef93f05b82ad3c980605f2cb444b5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7373a51e7998b508af7136530f3a997b286ce81c"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39469",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:07:55.313333Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:41.781Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ac8a2fe22bdde9eecce2a42cf5cab79333fb428",
              "status": "affected",
              "version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
              "versionType": "git"
            },
            {
              "lessThan": "405b71f1251e5ae865f53bd27c45114e6c83bee3",
              "status": "affected",
              "version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
              "versionType": "git"
            },
            {
              "lessThan": "c77ad608df6c091fe64ecb91f41ef7cb465587f1",
              "status": "affected",
              "version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
              "versionType": "git"
            },
            {
              "lessThan": "11a2edb70356a2202dcb7c9c189c8356ab4752cd",
              "status": "affected",
              "version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
              "versionType": "git"
            },
            {
              "lessThan": "129dcd3e7d036218db3f59c82d82004b9539ed82",
              "status": "affected",
              "version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
              "versionType": "git"
            },
            {
              "lessThan": "d18b05eda7fa77f02114f15b02c009f28ee42346",
              "status": "affected",
              "version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
              "versionType": "git"
            },
            {
              "lessThan": "59f14875a96ef93f05b82ad3c980605f2cb444b5",
              "status": "affected",
              "version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
              "versionType": "git"
            },
            {
              "lessThan": "7373a51e7998b508af7136530f3a997b286ce81c",
              "status": "affected",
              "version": "2ba466d74ed74f073257f86e61519cb8f8f46184",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.317",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.279",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.317",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.279",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.221",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.5",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors\n\nThe error handling in nilfs_empty_dir() when a directory folio/page read\nfails is incorrect, as in the old ext2 implementation, and if the\nfolio/page cannot be read or nilfs_check_folio() fails, it will falsely\ndetermine the directory as empty and corrupt the file system.\n\nIn addition, since nilfs_empty_dir() does not immediately return on a\nfailed folio/page read, but continues to loop, this can cause a long loop\nwith I/O if i_size of the directory\u0027s inode is also corrupted, causing the\nlog writer thread to wait and hang, as reported by syzbot.\n\nFix these issues by making nilfs_empty_dir() immediately return a false\nvalue (0) if it fails to get a directory folio/page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the local `rmdir(2)`/`rename(2)` syscall path on a mounted nilfs2 filesystem, with the malicious directory state supplied by a crafted nilfs2 image (automounted removable media, loop-mounted file, or admin-mounted volume). No network protocol handler is involved in the vulnerable function itself.\nAC:L - The attacker fully controls the on-disk directory: setting a corrupt `rec_len`/alignment/inode number so `nilfs_check_folio()` deterministically fails, and setting a huge `i_size` (read unvalidated at `inode.c:412`) so `dir_pages()` yields ~2^51 iterations. Both the false \"empty\" verdict and the segctor-sem hang follow deterministically with no race, timing window, or memory-layout dependency.\nPR:L - Once the filesystem is mounted, any ordinary unprivileged local user with write access to a directory on it triggers the bug with a single `rmdir()` or `rename()` \u2014 no capability, no root, and no `CAP_SYS_ADMIN` is needed for the triggering syscall itself.\nUI:N - No action by a second user is required: on a kiosk, desktop, or embedded system with udisks2/systemd automount, inserting the crafted volume is performed by the attacker and mounting is done by a daemon, after which the attacker issues the `rmdir()` themselves.\nS:U - The damage \u2014 corrupted nilfs2 metadata and a wedged log-writer thread \u2014 stays entirely within the kernel\u0027s own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an incorrect boolean return, not a memory-safety violation: `nilfs_check_folio()` still bounds every entry walk, and the `fail:` label in `nilfs_get_folio()` already releases the folio, so there is no out-of-bounds read, no use-after-free, and no kernel pointer or adjacent-memory disclosure.\nI:H - The false \"directory is empty\" verdict lets `nilfs_rmdir()` unlink a populated directory (`i_size = 0`, `drop_nlink()`) and lets `nilfs_rename()` overwrite one, orphaning the entire subtree and, as the fix states, corrupting the file system \u2014 silent, unauthorized destruction of stored data and metadata that the kernel then continues to operate on.\nA:H - With a corrupted `i_size` the loop performs an effectively unbounded sequence of failing reads with no `cond_resched()` or signal check while holding `ns_segctor_sem` for read and `sb_start_intwrite()`, so the segctord log writer blocks forever on `down_write()` \u2014 the syzbot hung-task hang \u2014 stalling all writeback, sync, freeze, and umount on that filesystem and panicking the box if `hung_task_panic` is set."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:27.521Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ac8a2fe22bdde9eecce2a42cf5cab79333fb428"
        },
        {
          "url": "https://git.kernel.org/stable/c/405b71f1251e5ae865f53bd27c45114e6c83bee3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c77ad608df6c091fe64ecb91f41ef7cb465587f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/11a2edb70356a2202dcb7c9c189c8356ab4752cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/129dcd3e7d036218db3f59c82d82004b9539ed82"
        },
        {
          "url": "https://git.kernel.org/stable/c/d18b05eda7fa77f02114f15b02c009f28ee42346"
        },
        {
          "url": "https://git.kernel.org/stable/c/59f14875a96ef93f05b82ad3c980605f2cb444b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/7373a51e7998b508af7136530f3a997b286ce81c"
        }
      ],
      "title": "nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39469",
    "datePublished": "2024-06-25T14:28:55.581Z",
    "dateReserved": "2024-06-25T14:23:23.745Z",
    "dateUpdated": "2026-08-05T11:33:27.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2ac8a2fe22bdde9eecce2a42cf5cab79333fb428\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/405b71f1251e5ae865f53bd27c45114e6c83bee3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c77ad608df6c091fe64ecb91f41ef7cb465587f1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/11a2edb70356a2202dcb7c9c189c8356ab4752cd\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/129dcd3e7d036218db3f59c82d82004b9539ed82\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d18b05eda7fa77f02114f15b02c009f28ee42346\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/59f14875a96ef93f05b82ad3c980605f2cb444b5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7373a51e7998b508af7136530f3a997b286ce81c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:56:03.781Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39469\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:07:55.313333Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:25.253Z\"}}], \"cna\": {\"title\": \"nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached through the local `rmdir(2)`/`rename(2)` syscall path on a mounted nilfs2 filesystem, with the malicious directory state supplied by a crafted nilfs2 image (automounted removable media, loop-mounted file, or admin-mounted volume). No network protocol handler is involved in the vulnerable function itself.\\nAC:L - The attacker fully controls the on-disk directory: setting a corrupt `rec_len`/alignment/inode number so `nilfs_check_folio()` deterministically fails, and setting a huge `i_size` (read unvalidated at `inode.c:412`) so `dir_pages()` yields ~2^51 iterations. Both the false \\\"empty\\\" verdict and the segctor-sem hang follow deterministically with no race, timing window, or memory-layout dependency.\\nPR:L - Once the filesystem is mounted, any ordinary unprivileged local user with write access to a directory on it triggers the bug with a single `rmdir()` or `rename()` \\u2014 no capability, no root, and no `CAP_SYS_ADMIN` is needed for the triggering syscall itself.\\nUI:N - No action by a second user is required: on a kiosk, desktop, or embedded system with udisks2/systemd automount, inserting the crafted volume is performed by the attacker and mounting is done by a daemon, after which the attacker issues the `rmdir()` themselves.\\nS:U - The damage \\u2014 corrupted nilfs2 metadata and a wedged log-writer thread \\u2014 stays entirely within the kernel\u0027s own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\\nC:N - The defect is an incorrect boolean return, not a memory-safety violation: `nilfs_check_folio()` still bounds every entry walk, and the `fail:` label in `nilfs_get_folio()` already releases the folio, so there is no out-of-bounds read, no use-after-free, and no kernel pointer or adjacent-memory disclosure.\\nI:H - The false \\\"directory is empty\\\" verdict lets `nilfs_rmdir()` unlink a populated directory (`i_size = 0`, `drop_nlink()`) and lets `nilfs_rename()` overwrite one, orphaning the entire subtree and, as the fix states, corrupting the file system \\u2014 silent, unauthorized destruction of stored data and metadata that the kernel then continues to operate on.\\nA:H - With a corrupted `i_size` the loop performs an effectively unbounded sequence of failing reads with no `cond_resched()` or signal check while holding `ns_segctor_sem` for read and `sb_start_intwrite()`, so the segctord log writer blocks forever on `down_write()` \\u2014 the syzbot hung-task hang \\u2014 stalling all writeback, sync, freeze, and umount on that filesystem and panicking the box if `hung_task_panic` is set.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2ba466d74ed74f073257f86e61519cb8f8f46184\", \"lessThan\": \"2ac8a2fe22bdde9eecce2a42cf5cab79333fb428\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2ba466d74ed74f073257f86e61519cb8f8f46184\", \"lessThan\": \"405b71f1251e5ae865f53bd27c45114e6c83bee3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2ba466d74ed74f073257f86e61519cb8f8f46184\", \"lessThan\": \"c77ad608df6c091fe64ecb91f41ef7cb465587f1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2ba466d74ed74f073257f86e61519cb8f8f46184\", \"lessThan\": \"11a2edb70356a2202dcb7c9c189c8356ab4752cd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2ba466d74ed74f073257f86e61519cb8f8f46184\", \"lessThan\": \"129dcd3e7d036218db3f59c82d82004b9539ed82\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2ba466d74ed74f073257f86e61519cb8f8f46184\", \"lessThan\": \"d18b05eda7fa77f02114f15b02c009f28ee42346\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2ba466d74ed74f073257f86e61519cb8f8f46184\", \"lessThan\": \"59f14875a96ef93f05b82ad3c980605f2cb444b5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2ba466d74ed74f073257f86e61519cb8f8f46184\", \"lessThan\": \"7373a51e7998b508af7136530f3a997b286ce81c\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nilfs2/dir.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.30\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.30\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.317\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.279\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.221\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.95\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.35\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nilfs2/dir.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2ac8a2fe22bdde9eecce2a42cf5cab79333fb428\"}, {\"url\": \"https://git.kernel.org/stable/c/405b71f1251e5ae865f53bd27c45114e6c83bee3\"}, {\"url\": \"https://git.kernel.org/stable/c/c77ad608df6c091fe64ecb91f41ef7cb465587f1\"}, {\"url\": \"https://git.kernel.org/stable/c/11a2edb70356a2202dcb7c9c189c8356ab4752cd\"}, {\"url\": \"https://git.kernel.org/stable/c/129dcd3e7d036218db3f59c82d82004b9539ed82\"}, {\"url\": \"https://git.kernel.org/stable/c/d18b05eda7fa77f02114f15b02c009f28ee42346\"}, {\"url\": \"https://git.kernel.org/stable/c/59f14875a96ef93f05b82ad3c980605f2cb444b5\"}, {\"url\": \"https://git.kernel.org/stable/c/7373a51e7998b508af7136530f3a997b286ce81c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors\\n\\nThe error handling in nilfs_empty_dir() when a directory folio/page read\\nfails is incorrect, as in the old ext2 implementation, and if the\\nfolio/page cannot be read or nilfs_check_folio() fails, it will falsely\\ndetermine the directory as empty and corrupt the file system.\\n\\nIn addition, since nilfs_empty_dir() does not immediately return on a\\nfailed folio/page read, but continues to loop, this can cause a long loop\\nwith I/O if i_size of the directory\u0027s inode is also corrupted, causing the\\nlog writer thread to wait and hang, as reported by syzbot.\\n\\nFix these issues by making nilfs_empty_dir() immediately return a false\\nvalue (0) if it fails to get a directory folio/page.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.317\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.279\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.221\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.162\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.95\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.35\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.5\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"2.6.30\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:33:27.521Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39469\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:33:27.521Z\", \"dateReserved\": \"2024-06-25T14:23:23.745Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-25T14:28:55.581Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.