CVE-2024-26773

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-26773", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.176Z", "datePublished": "2024-04-03T17:00:59.757Z", "dateUpdated": "2026-10-15T00:38:30.960Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:10.867Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\n\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\next4_mb_try_best_found() to avoid allocating blocks from a group with a\ncorrupted block bitmap in the following concurrency and making the\nsituation worse.\n\next4_mb_regular_allocator\n ext4_lock_group(sb, group)\n ext4_mb_good_group\n // check if the group bbitmap is corrupted\n ext4_mb_complex_scan_group\n // Scan group gets ac_b_ex but doesn't use it\n ext4_unlock_group(sb, group)\n ext4_mark_group_bitmap_corrupted(group)\n // The block bitmap was corrupted during\n // the group unlock gap.\n ext4_mb_try_best_found\n ext4_lock_group(ac->ac_sb, group)\n ext4_mb_use_best_found\n mb_mark_used\n // Allocating blocks in block bitmap corrupted group"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable allocator is reached only through local filesystem operations (`write()`, `fallocate()`, truncate/extend) on a mounted ext4 filesystem via `ext4_mb_new_blocks()` \u2192 `ext4_mb_regular_allocator()`. No network protocol handler parses data that reaches this code directly.\nAC:L - The attacker drives both sides of the window \u2014 many concurrent writer threads on the same block group both create the allocation pressure that forces the `ac_b_ex.fe_len > 0 && !AC_STATUS_FOUND` fallback into `ext4_mb_try_best_found()` and supply the concurrent free/scan that flags the group corrupt \u2014 and the same-thread path (corruption detected inside `ext4_mb_complex_scan_group()`, `break`, then the fallback allocation) needs no race at all; the sequence can be retried indefinitely at no cost.\nPR:L - Only an unprivileged local account with write access to any ext4 mount (`/tmp`, `/home`, an app data partition on Android/embedded) is needed; no capability, mount privilege, or fs-specific permission is consulted on the allocation path.\nUI:N - Once a group is flagged corrupt \u2014 by media aging on eMMC/flash in embedded and automotive deployments, by a prior detected double-free, or by the free-count mismatch the attacker's own concurrent allocation traffic provokes \u2014 exploitation is entirely the attacker's own syscalls, with no victim mount or file access required.\nS:U - The damaged resources are the ext4 block bitmap, buddy state, and file data, all managed by the same kernel security authority as the vulnerable code; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Allocating from a group whose bitmap is known-inconsistent hands the attacker's file blocks that are still referenced by other inodes \u2014 the double-free detector's case is exactly \"this block is still owned by another file\" \u2014 so simply reading the attacker's own new file discloses other users' and system files' on-disk contents.\nI:H - The same double allocation lets attacker-controlled writes land on blocks belonging to other users' files and, where the bitmap accounting is wrong for metadata blocks, on ext4 metadata (inode table, bitmaps), corrupting foreign data and inode fields in a way that is leverageable for privilege escalation.\nA:H - Operating on the inconsistent buddy triggers `BUG_ON(ord <= 0)` / `BUG_ON((start >> ord) >= max)` in `mb_mark_used()`, `bb_free`/`bb_fragments` underflow feeding the divide-by-zero in `mb_update_avg_fragment_size()`, and `ext4_grp_locked_error()`, which forces the filesystem read-only by default and panics the kernel with `errors=panic`."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/mballoc.c"], "versions": [{"version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "21f8cfe79f776287459343e9cfa6055af61328ea", "status": "affected", "versionType": "git"}, {"version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "260fc96283c0f594de18a1b045faf6d8fb42874d", "status": "affected", "versionType": "git"}, {"version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "927794a02169778c9c2e7b25c768ab3ea8c1dc03", "status": "affected", "versionType": "git"}, {"version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "4c21fa60a6f4606f6214a38f50612b17b2f738f5", "status": "affected", "versionType": "git"}, {"version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "f97e75fa4e12b0aa0224e83fcbda8853ac2adf36", "status": "affected", "versionType": "git"}, {"version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "0184747b552d6b5a14db3b7fcc3b792ce64dedd1", "status": "affected", "versionType": "git"}, {"version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "a2576ae9a35c078e488f2c573e9e6821d651fbbe", "status": "affected", "versionType": "git"}, {"version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "4530b3660d396a646aad91a787b6ab37cf604b53", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/mballoc.c"], "versions": [{"version": "3.12", "status": "affected"}, {"version": "0", "lessThan": "3.12", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.308", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.270", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.211", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.150", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.80", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.19", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.7", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "4.19.308"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "5.4.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "5.10.211"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "5.15.150"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.1.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.6.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.7.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea"}, {"url": "https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d"}, {"url": "https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03"}, {"url": "https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5"}, {"url": "https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36"}, {"url": "https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1"}, {"url": "https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe"}, {"url": "https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53"}], "title": "ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26773", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-03T18:50:26.209110Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:49:10.181Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.512Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}]}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:38:30.960Z"}, "affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.512Z"}}, {"affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:38:30.960Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26773", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-03T18:50:26.209110Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:21.835Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable allocator is reached only through local filesystem operations (`write()`, `fallocate()`, truncate/extend) on a mounted ext4 filesystem via `ext4_mb_new_blocks()` \u2192 `ext4_mb_regular_allocator()`. No network protocol handler parses data that reaches this code directly.\nAC:L - The attacker drives both sides of the window \u2014 many concurrent writer threads on the same block group both create the allocation pressure that forces the `ac_b_ex.fe_len > 0 && !AC_STATUS_FOUND` fallback into `ext4_mb_try_best_found()` and supply the concurrent free/scan that flags the group corrupt \u2014 and the same-thread path (corruption detected inside `ext4_mb_complex_scan_group()`, `break`, then the fallback allocation) needs no race at all; the sequence can be retried indefinitely at no cost.\nPR:L - Only an unprivileged local account with write access to any ext4 mount (`/tmp`, `/home`, an app data partition on Android/embedded) is needed; no capability, mount privilege, or fs-specific permission is consulted on the allocation path.\nUI:N - Once a group is flagged corrupt \u2014 by media aging on eMMC/flash in embedded and automotive deployments, by a prior detected double-free, or by the free-count mismatch the attacker's own concurrent allocation traffic provokes \u2014 exploitation is entirely the attacker's own syscalls, with no victim mount or file access required.\nS:U - The damaged resources are the ext4 block bitmap, buddy state, and file data, all managed by the same kernel security authority as the vulnerable code; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Allocating from a group whose bitmap is known-inconsistent hands the attacker's file blocks that are still referenced by other inodes \u2014 the double-free detector's case is exactly \"this block is still owned by another file\" \u2014 so simply reading the attacker's own new file discloses other users' and system files' on-disk contents.\nI:H - The same double allocation lets attacker-controlled writes land on blocks belonging to other users' files and, where the bitmap accounting is wrong for metadata blocks, on ext4 metadata (inode table, bitmaps), corrupting foreign data and inode fields in a way that is leverageable for privilege escalation.\nA:H - Operating on the inconsistent buddy triggers `BUG_ON(ord <= 0)` / `BUG_ON((start >> ord) >= max)` in `mb_mark_used()`, `bb_free`/`bb_fragments` underflow feeding the divide-by-zero in `mb_update_avg_fragment_size()`, and `ext4_grp_locked_error()`, which forces the filesystem read-only by default and panics the kernel with `errors=panic`."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "21f8cfe79f776287459343e9cfa6055af61328ea", "versionType": "git"}, {"status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "260fc96283c0f594de18a1b045faf6d8fb42874d", "versionType": "git"}, {"status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "927794a02169778c9c2e7b25c768ab3ea8c1dc03", "versionType": "git"}, {"status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "4c21fa60a6f4606f6214a38f50612b17b2f738f5", "versionType": "git"}, {"status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "f97e75fa4e12b0aa0224e83fcbda8853ac2adf36", "versionType": "git"}, {"status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "0184747b552d6b5a14db3b7fcc3b792ce64dedd1", "versionType": "git"}, {"status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "a2576ae9a35c078e488f2c573e9e6821d651fbbe", "versionType": "git"}, {"status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "lessThan": "4530b3660d396a646aad91a787b6ab37cf604b53", "versionType": "git"}], "programFiles": ["fs/ext4/mballoc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.12"}, {"status": "unaffected", "version": "0", "lessThan": "3.12", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.308", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.270", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.211", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.150", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.80", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.19", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.7", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ext4/mballoc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea"}, {"url": "https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d"}, {"url": "https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03"}, {"url": "https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5"}, {"url": "https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36"}, {"url": "https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1"}, {"url": "https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe"}, {"url": "https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\n\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\next4_mb_try_best_found() to avoid allocating blocks from a group with a\ncorrupted block bitmap in the following concurrency and making the\nsituation worse.\n\next4_mb_regular_allocator\n ext4_lock_group(sb, group)\n ext4_mb_good_group\n // check if the group bbitmap is corrupted\n ext4_mb_complex_scan_group\n // Scan group gets ac_b_ex but doesn't use it\n ext4_unlock_group(sb, group)\n ext4_mark_group_bitmap_corrupted(group)\n // The block bitmap was corrupted during\n // the group unlock gap.\n ext4_mb_try_best_found\n ext4_lock_group(ac->ac_sb, group)\n ext4_mb_use_best_found\n mb_mark_used\n // Allocating blocks in block bitmap corrupted group"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.308", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.270", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.211", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.150", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.80", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.19", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.7", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "3.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:10.867Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26773", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:38:30.960Z", "dateReserved": "2024-02-19T14:20:24.176Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-03T17:00:59.757Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ext4/mballoc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "21f8cfe79f776287459343e9cfa6055af61328ea", "status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "versionType": "git"}, {"lessThan": "260fc96283c0f594de18a1b045faf6d8fb42874d", "status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "versionType": "git"}, {"lessThan": "927794a02169778c9c2e7b25c768ab3ea8c1dc03", "status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "versionType": "git"}, {"lessThan": "4c21fa60a6f4606f6214a38f50612b17b2f738f5", "status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "versionType": "git"}, {"lessThan": "f97e75fa4e12b0aa0224e83fcbda8853ac2adf36", "status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "versionType": "git"}, {"lessThan": "0184747b552d6b5a14db3b7fcc3b792ce64dedd1", "status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "versionType": "git"}, {"lessThan": "a2576ae9a35c078e488f2c573e9e6821d651fbbe", "status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "versionType": "git"}, {"lessThan": "4530b3660d396a646aad91a787b6ab37cf604b53", "status": "affected", "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ext4/mballoc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.12"}, {"lessThan": "3.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.308", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.270", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.211", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.150", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.80", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.19", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6FB6042-3E0F-4A36-8DED-B3C350612BDC", "versionEndExcluding": "4.19.308", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D8044B1-C7E8-44A4-9F03-A4D7BCDB1721", "versionEndExcluding": "5.4.270", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7DDA4DCF-671D-415D-94DF-6E3C77DF0704", "versionEndExcluding": "5.10.211", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB6C60DE-9E0C-46C5-904D-D4F4031F8E95", "versionEndExcluding": "5.15.150", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA7850CE-97C9-4408-A348-6173296BCA2B", "versionEndExcluding": "6.1.80", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8D82004C-B2AE-4048-9344-32EFF65953B0", "versionEndExcluding": "6.6.19", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "575EE16B-67F2-4B5B-B5F8-1877715C898B", "versionEndExcluding": "6.7.7", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\n\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\next4_mb_try_best_found() to avoid allocating blocks from a group with a\ncorrupted block bitmap in the following concurrency and making the\nsituation worse.\n\next4_mb_regular_allocator\n ext4_lock_group(sb, group)\n ext4_mb_good_group\n // check if the group bbitmap is corrupted\n ext4_mb_complex_scan_group\n // Scan group gets ac_b_ex but doesn't use it\n ext4_unlock_group(sb, group)\n ext4_mark_group_bitmap_corrupted(group)\n // The block bitmap was corrupted during\n // the group unlock gap.\n ext4_mb_try_best_found\n ext4_lock_group(ac->ac_sb, group)\n ext4_mb_use_best_found\n mb_mark_used\n // Allocating blocks in block bitmap corrupted group"}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ext4: evite asignar bloques de un grupo da\u00f1ado en ext4_mb_try_best_found() Determine si el mapa de bits del bloque del grupo est\u00e1 da\u00f1ado antes de usar ac_b_ex en ext4_mb_try_best_found() para evitar asignar bloques de un grupo con un bloque da\u00f1ado mapa de bits en la siguiente concurrencia y empeorando la situaci\u00f3n. ext4_mb_regular_allocator ext4_lock_group(sb, group) ext4_mb_good_group // verifica si el bbitmap del grupo est\u00e1 da\u00f1ado ext4_mb_complex_scan_group // El grupo de escaneo obtiene ac_b_ex pero no lo usa ext4_unlock_group(sb, group) ext4_mark_group_bitmap_corrupted(group) // El mapa de bits del bloque se corrompi\u00f3 durante // el grupo desbloquea la brecha. ext4_mb_try_best_found ext4_lock_group(ac-&gt;ac_sb, group) ext4_mb_use_best_found mb_mark_used // Asignaci\u00f3n de bloques en un grupo da\u00f1ado de mapa de bits de bloques"}], "id": "CVE-2024-26773", "lastModified": "2026-10-15T01:17:22.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26773", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-04-03T18:50:26.209110Z", "version": "2.0.3"}}]}, "published": "2024-04-03T17:15:53.080", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:5102", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:5101", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.16.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:6753", "cpe": "cpe:/o:redhat:rhel_aus:8.6", "package": "kernel-0:4.18.0-372.123.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-09-18T00:00:00Z"}, {"advisory": "RHSA-2024:6753", "cpe": "cpe:/o:redhat:rhel_tus:8.6", "package": "kernel-0:4.18.0-372.123.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-09-18T00:00:00Z"}, {"advisory": "RHSA-2024:6753", "cpe": "cpe:/o:redhat:rhel_e4s:8.6", "package": "kernel-0:4.18.0-372.123.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-09-18T00:00:00Z"}, {"advisory": "RHSA-2024:5255", "cpe": "cpe:/o:redhat:rhel_eus:8.8", "package": "kernel-0:4.18.0-477.67.1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-08-13T00:00:00Z"}, {"advisory": "RHSA-2024:4928", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.28.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-07-31T00:00:00Z"}, {"advisory": "RHSA-2024:4928", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.28.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-07-31T00:00:00Z"}, {"advisory": "RHSA-2024:4823", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.75.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-07-24T00:00:00Z"}, {"advisory": "RHSA-2024:4831", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.75.1.rt14.360.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-07-24T00:00:00Z"}], "bugzilla": {"description": "kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()", "id": "2273236", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273236"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-229", "details": ["In the Linux kernel, the following vulnerability has been resolved:\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\next4_mb_try_best_found() to avoid allocating blocks from a group with a\ncorrupted block bitmap in the following concurrency and making the\nsituation worse.\next4_mb_regular_allocator\next4_lock_group(sb, group)\next4_mb_good_group\n// check if the group bbitmap is corrupted\next4_mb_complex_scan_group\n// Scan group gets ac_b_ex but doesn't use it\next4_unlock_group(sb, group)\next4_mark_group_bitmap_corrupted(group)\n// The block bitmap was corrupted during\n// the group unlock gap.\next4_mb_try_best_found\next4_lock_group(ac->ac_sb, group)\next4_mb_use_best_found\nmb_mark_used\n// Allocating blocks in block bitmap corrupted group", "A vulnerability was found in the ext4_mb_try_best_found() function in the Linux kernel. This issue could lead to memory corruption or crashes due to the allocation of blocks from a group with a corrupted block bitmap."], "name": "CVE-2024-26773", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26773\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26773\nhttps://lore.kernel.org/linux-cve-announce/2024040308-CVE-2024-26773-a314@gregkh/T"], "threat_severity": "Moderate"}

{}