CVE-2024-53221f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
- 5.5MediumCVSS base score
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix null-ptr-deref in f2fs_submit_page_bio() There's issue as follows when concurrently installing the f2fs.ko module and mounting the f2fs file system: KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__bio_alloc+0x2fb/0x6c0 [f2fs] Call Trace: <TASK> f2fs_submit_page_bio+0x126/0x8b0 [f2fs] __get_meta_page+0x1d4/0x920 [f2fs] get_checkpoint_version.constprop.0+0x2b/0x3c0 [f2fs] validate_checkpoint+0xac/0x290 [f2fs] f2fs_get_valid_checkpoint+0x207/0x950 [f2fs] f2fs_fill_super+0x1007/0x39b0 [f2fs] mount_bdev+0x183/0x250 legacy_get_tree+0xf4/0x1e0 vfs_get_tree+0x88/0x340 do_new_mount+0x283/0x5e0 path_mount+0x2b2/0x15b0 __x64_sys_mount+0x1fe/0x270 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Above issue happens as the biset of the f2fs file system is not initialized before register "f2fs_fs_type". To address above issue just register "f2fs_fs_type" at the last in init_f2fs_fs(). Ensure that all f2fs file system resources are initialized.
Timeline
ID reserved
By Linux
- 38 days later
· 38 days later
Published
- 17 months later
· 17 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected f543805fcd60f3f9a491cfa2f2dc9284d2569c28 – < 4289be8465924748daa9bf14866eb7f0987d4e39
- affected f543805fcd60f3f9a491cfa2f2dc9284d2569c28 – < bd9197b72d772be7bccc3b66c83a3157cfe2f96f
- affected f543805fcd60f3f9a491cfa2f2dc9284d2569c28 – < 8dddc12d03248755d9f709bc1eb9e3ea2bf1b322
- affected f543805fcd60f3f9a491cfa2f2dc9284d2569c28 – < 32f5e291b7677495f98246eec573767430321c08
- affected f543805fcd60f3f9a491cfa2f2dc9284d2569c28 – < 9e11b1d5fda972f6be60ab732976a7c8e064cd56
- affected f543805fcd60f3f9a491cfa2f2dc9284d2569c28 – < b7d0a97b28083084ebdd8e5c6bccd12e6ec18faa
- affected 5.6
- unaffected < 5.6
- unaffected 5.15.209 – ≤ 5.15.*
- unaffected 6.1.175 – ≤ 6.1.*
- unaffected 6.6.72 – ≤ 6.6.*
- unaffected 6.11.11 – ≤ 6.11.*
- unaffected 6.12.2 – ≤ 6.12.*
- unaffected 6.13 – ≤ *
References
References6
- https://git.kernel.org/stable/c/4289be8465924748daa9bf14866eb7f0987d4e39 (opens in a new tab)
- https://git.kernel.org/stable/c/bd9197b72d772be7bccc3b66c83a3157cfe2f96f (opens in a new tab)
- https://git.kernel.org/stable/c/8dddc12d03248755d9f709bc1eb9e3ea2bf1b322 (opens in a new tab)
- https://git.kernel.org/stable/c/32f5e291b7677495f98246eec573767430321c08 (opens in a new tab)
- https://git.kernel.org/stable/c/9e11b1d5fda972f6be60ab732976a7c8e064cd56 (opens in a new tab)
- https://git.kernel.org/stable/c/b7d0a97b28083084ebdd8e5c6bccd12e6ec18faa (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-51893 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-53221)Record last updated .