CVE-2024-26697nilfs2: fix data corruption in dsync block recovery for small block sizes
- 7.8HighCVSS base score
- 0.26%Exploitation in 30 daysEPSS · top 82% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in dsync block recovery for small block sizes The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the on-page offset when copying repair data to the file's page cache. In environments where the block size is smaller than the page size, this flaw can cause data corruption and leak uninitialized memory bytes during the recovery process. Fix these issues by correcting this byte offset calculation on the page.
Timeline
ID reserved
By Linux
- 44 days later
· 44 days later
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.26% · top 82% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b – < 5278c3eb6bf5896417572b52adb6be9d26e92f65
- affected 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b – < a6efe6dbaaf504f5b3f8a5c3f711fe54e7dda0ba
- affected 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b – < 364a66be2abdcd4fd426ffa44d9b8f40aafb3caa
- affected 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b – < 120f7fa2008e3bd8b7680b4ab5df942decf60fd5
- affected 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b – < 9c9c68d64fd3284f7097ed6ae057c8441f39fcd3
- affected 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b – < 2e1480538ef60bfee5473dfe02b1ecbaf1a4aa0d
- affected 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b – < 2000016bab499074e6248ea85aeea7dd762355d9
- affected 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b – < 67b8bcbaed4777871bb0dcc888fb02a614a98ab1
- affected 2.6.30
- unaffected < 2.6.30
- unaffected 4.19.307 – ≤ 4.19.*
- unaffected 5.4.269 – ≤ 5.4.*
- unaffected 5.10.210 – ≤ 5.10.*
- unaffected 5.15.149 – ≤ 5.15.*
- unaffected 6.1.79 – ≤ 6.1.*
- unaffected 6.6.18 – ≤ 6.6.*
- unaffected 6.7.6 – ≤ 6.7.*
- unaffected 6.8 – ≤ *
References
References10
- https://git.kernel.org/stable/c/5278c3eb6bf5896417572b52adb6be9d26e92f65 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/a6efe6dbaaf504f5b3f8a5c3f711fe54e7dda0ba (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/364a66be2abdcd4fd426ffa44d9b8f40aafb3caa (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/120f7fa2008e3bd8b7680b4ab5df942decf60fd5 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/9c9c68d64fd3284f7097ed6ae057c8441f39fcd3 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/2e1480538ef60bfee5473dfe02b1ecbaf1a4aa0d (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/2000016bab499074e6248ea85aeea7dd762355d9 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/67b8bcbaed4777871bb0dcc888fb02a614a98ab1 (opens in a new tab)x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html (opens in a new tab)x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-23959 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-26697)Record last updated .