CVE-2024-26869

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26869", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.184Z", "datePublished": "2024-04-17T10:27:30.100Z", "dateUpdated": "2026-10-30T12:17:55.855Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:17:55.855Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to truncate meta inode pages forcely\n\nBelow race case can cause data corruption:\n\nThread A\t\t\t\tGC thread\n\t\t\t\t\t- gc_data_segment\n\t\t\t\t\t - ra_data_block\n\t\t\t\t\t - locked meta_inode page\n- f2fs_inplace_write_data\n - invalidate_mapping_pages\n : fail to invalidate meta_inode page\n due to lock failure or dirty|writeback\n status\n - f2fs_submit_page_bio\n : write last dirty data to old blkaddr\n\t\t\t\t\t - move_data_block\n\t\t\t\t\t - load old data from meta_inode page\n\t\t\t\t\t - f2fs_submit_page_write\n\t\t\t\t\t : write old data to new blkaddr\n\nBecause invalidate_mapping_pages() will skip invalidating page which\nhas unclear status including locked, dirty, writeback and so on, so\nwe need to use truncate_inode_pages_range() instead of\ninvalidate_mapping_pages() to make sure meta_inode page will be dropped."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable paths are entered through ordinary local file operations on a mounted f2fs volume \u2014 buffered overwrite with IPU, fdatasync, or O_DIRECT write \u2014 with the racing side driven by the in-kernel GC thread. No network or physical access is involved.\nAC:L - The attacker controls the write side outright and can drive the GC side at will by fragmenting/filling the filesystem to keep background and foreground GC continuously active; the invalidation failure window is the full duration of GC's read bio, during which ra_data_block() holds the meta page locked, so the skip is the expected outcome rather than a narrow accident, and the attempt can be repeated indefinitely.\nPR:L - Any unprivileged local user with write access to a file on an f2fs volume can reach both f2fs_inplace_write_data() and the F2FS_GET_BLOCK_DIO path; the CAP_SYS_ADMIN check on f2fs_ioc_gc() is not a barrier because the default background GC thread and f2fs_balance_fs()-triggered foreground GC provide the racing side without any privilege.\nUI:N - The attacker's own process performs the writes and the GC thread runs automatically as a kernel thread; no victim action of any kind is required.\nS:U - The corruption is confined to the f2fs filesystem and kernel managing it, with no crossing into a different security authority such as a hypervisor or IOMMU domain.\nC:H - META_MAPPING is a global cache keyed by physical block address, and f2fs_invalidate_blocks() can likewise fail to evict, so a stale page can outlive the block's reallocation to a different inode \u2014 move_data_block() then copies the previous owner's on-disk content into the attacker's file, disclosing another user's data (plaintext for verity/compressed inodes).\nI:H - This is a direct, silent, persistent on-disk data corruption primitive: freshly written data is overwritten with stale contents, and via physical-block reuse an attacker's stale data can be written into another inode's blocks, modifying data outside the attacker's control with no error reported.\nA:H - Corrupted blocks landing in compressed clusters or encrypted directory/dentry blocks produce decompression and directory-parse failures that raise EFSCORRUPTED, set SBI_NEED_FSCK, and trigger f2fs_handle_error() shutdown (panic under errors=panic or CONFIG_F2FS_CHECK_FS), alongside irrecoverable loss of the corrupted file data."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/checkpoint.c", "fs/f2fs/f2fs.h", "fs/f2fs/segment.c", "include/linux/f2fs_fs.h"], "versions": [{"version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "lessThan": "0721a4f85d12a364002a9476c84b930fbc993f83", "status": "affected", "versionType": "git"}, {"version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "lessThan": "c92f2927df860a60ba815d3ee610a944b92a8694", "status": "affected", "versionType": "git"}, {"version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "lessThan": "77bfdb89cc222fc7bfe198eda77bdc427d5ac189", "status": "affected", "versionType": "git"}, {"version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "lessThan": "04226d8e3c4028dc451e9d8777356ec0f7919253", "status": "affected", "versionType": "git"}, {"version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "lessThan": "9f0c4a46be1fe9b97dbe66d49204c1371e3ece65", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/checkpoint.c", "fs/f2fs/f2fs.h", "fs/f2fs/segment.c", "include/linux/f2fs_fs.h"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.23", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.11", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.2", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.7.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.8.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0721a4f85d12a364002a9476c84b930fbc993f83"}, {"url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"}, {"url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"}, {"url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"}, {"url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"}], "title": "f2fs: fix to truncate meta inode pages forcely", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-12T17:28:33.962208Z", "id": "CVE-2024-26869", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-12T17:31:41.499Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:04.218Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:04.218Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26869", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-12T17:28:33.962208Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-12T17:28:41.121Z"}}], "cna": {"title": "f2fs: fix to truncate meta inode pages forcely", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable paths are entered through ordinary local file operations on a mounted f2fs volume \u2014 buffered overwrite with IPU, fdatasync, or O_DIRECT write \u2014 with the racing side driven by the in-kernel GC thread. No network or physical access is involved.\nAC:L - The attacker controls the write side outright and can drive the GC side at will by fragmenting/filling the filesystem to keep background and foreground GC continuously active; the invalidation failure window is the full duration of GC's read bio, during which ra_data_block() holds the meta page locked, so the skip is the expected outcome rather than a narrow accident, and the attempt can be repeated indefinitely.\nPR:L - Any unprivileged local user with write access to a file on an f2fs volume can reach both f2fs_inplace_write_data() and the F2FS_GET_BLOCK_DIO path; the CAP_SYS_ADMIN check on f2fs_ioc_gc() is not a barrier because the default background GC thread and f2fs_balance_fs()-triggered foreground GC provide the racing side without any privilege.\nUI:N - The attacker's own process performs the writes and the GC thread runs automatically as a kernel thread; no victim action of any kind is required.\nS:U - The corruption is confined to the f2fs filesystem and kernel managing it, with no crossing into a different security authority such as a hypervisor or IOMMU domain.\nC:H - META_MAPPING is a global cache keyed by physical block address, and f2fs_invalidate_blocks() can likewise fail to evict, so a stale page can outlive the block's reallocation to a different inode \u2014 move_data_block() then copies the previous owner's on-disk content into the attacker's file, disclosing another user's data (plaintext for verity/compressed inodes).\nI:H - This is a direct, silent, persistent on-disk data corruption primitive: freshly written data is overwritten with stale contents, and via physical-block reuse an attacker's stale data can be written into another inode's blocks, modifying data outside the attacker's control with no error reported.\nA:H - Corrupted blocks landing in compressed clusters or encrypted directory/dentry blocks produce decompression and directory-parse failures that raise EFSCORRUPTED, set SBI_NEED_FSCK, and trigger f2fs_handle_error() shutdown (panic under errors=panic or CONFIG_F2FS_CHECK_FS), alongside irrecoverable loss of the corrupted file data."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "lessThan": "0721a4f85d12a364002a9476c84b930fbc993f83", "versionType": "git"}, {"status": "affected", "version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "lessThan": "c92f2927df860a60ba815d3ee610a944b92a8694", "versionType": "git"}, {"status": "affected", "version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "lessThan": "77bfdb89cc222fc7bfe198eda77bdc427d5ac189", "versionType": "git"}, {"status": "affected", "version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "lessThan": "04226d8e3c4028dc451e9d8777356ec0f7919253", "versionType": "git"}, {"status": "affected", "version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "lessThan": "9f0c4a46be1fe9b97dbe66d49204c1371e3ece65", "versionType": "git"}], "programFiles": ["fs/f2fs/checkpoint.c", "fs/f2fs/f2fs.h", "fs/f2fs/segment.c", "include/linux/f2fs_fs.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"status": "unaffected", "version": "0", "lessThan": "4.19", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.23", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.11", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8.2", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/f2fs/checkpoint.c", "fs/f2fs/f2fs.h", "fs/f2fs/segment.c", "include/linux/f2fs_fs.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0721a4f85d12a364002a9476c84b930fbc993f83"}, {"url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"}, {"url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"}, {"url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"}, {"url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to truncate meta inode pages forcely\n\nBelow race case can cause data corruption:\n\nThread A\t\t\t\tGC thread\n\t\t\t\t\t- gc_data_segment\n\t\t\t\t\t - ra_data_block\n\t\t\t\t\t - locked meta_inode page\n- f2fs_inplace_write_data\n - invalidate_mapping_pages\n : fail to invalidate meta_inode page\n due to lock failure or dirty|writeback\n status\n - f2fs_submit_page_bio\n : write last dirty data to old blkaddr\n\t\t\t\t\t - move_data_block\n\t\t\t\t\t - load old data from meta_inode page\n\t\t\t\t\t - f2fs_submit_page_write\n\t\t\t\t\t : write old data to new blkaddr\n\nBecause invalidate_mapping_pages() will skip invalidating page which\nhas unclear status including locked, dirty, writeback and so on, so\nwe need to use truncate_inode_pages_range() instead of\ninvalidate_mapping_pages() to make sure meta_inode page will be dropped."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.23", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.11", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.2", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "4.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:17:55.855Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26869", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:17:55.855Z", "dateReserved": "2024-02-19T14:20:24.184Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-17T10:27:30.100Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/f2fs/checkpoint.c", "fs/f2fs/f2fs.h", "fs/f2fs/segment.c", "include/linux/f2fs_fs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0721a4f85d12a364002a9476c84b930fbc993f83", "status": "affected", "version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "versionType": "git"}, {"lessThan": "c92f2927df860a60ba815d3ee610a944b92a8694", "status": "affected", "version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "versionType": "git"}, {"lessThan": "77bfdb89cc222fc7bfe198eda77bdc427d5ac189", "status": "affected", "version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "versionType": "git"}, {"lessThan": "04226d8e3c4028dc451e9d8777356ec0f7919253", "status": "affected", "version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "versionType": "git"}, {"lessThan": "9f0c4a46be1fe9b97dbe66d49204c1371e3ece65", "status": "affected", "version": "6aa58d8ad20a3323f42274c25820a6f54192422d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/f2fs/checkpoint.c", "fs/f2fs/f2fs.h", "fs/f2fs/segment.c", "include/linux/f2fs_fs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.23", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.11", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E5CF199-446C-49E6-B4B3-115B6F6567B6", "versionEndExcluding": "6.6.23", "versionStartIncluding": "4.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD", "versionEndExcluding": "6.7.11", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "543A75FF-25B8-4046-A514-1EA8EDD87AB1", "versionEndExcluding": "6.8.2", "versionStartIncluding": "6.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to truncate meta inode pages forcely\n\nBelow race case can cause data corruption:\n\nThread A\t\t\t\tGC thread\n\t\t\t\t\t- gc_data_segment\n\t\t\t\t\t - ra_data_block\n\t\t\t\t\t - locked meta_inode page\n- f2fs_inplace_write_data\n - invalidate_mapping_pages\n : fail to invalidate meta_inode page\n due to lock failure or dirty|writeback\n status\n - f2fs_submit_page_bio\n : write last dirty data to old blkaddr\n\t\t\t\t\t - move_data_block\n\t\t\t\t\t - load old data from meta_inode page\n\t\t\t\t\t - f2fs_submit_page_write\n\t\t\t\t\t : write old data to new blkaddr\n\nBecause invalidate_mapping_pages() will skip invalidating page which\nhas unclear status including locked, dirty, writeback and so on, so\nwe need to use truncate_inode_pages_range() instead of\ninvalidate_mapping_pages() to make sure meta_inode page will be dropped."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: correcci\u00f3n para truncar las p\u00e1ginas de meta-inodo a la fuerza El siguiente caso de carrera puede causar corrupci\u00f3n de datos: Hilo Un hilo de GC - gc_data_segment - ra_data_block - p\u00e1gina de meta_inodo bloqueada - f2fs_inplace_write_data - invalidate_mapping_pages: no se puede invalidar meta_inode p\u00e1gina debido a falla de bloqueo o estado sucio|reescritura - f2fs_submit_page_bio: escribe los \u00faltimos datos sucios en el blkaddr antiguo - move_data_block - carga datos antiguos de la p\u00e1gina meta_inode - f2fs_submit_page_write: escribe datos antiguos en el blkaddr nuevo Porque invalidate_mapping_pages() omitir\u00e1 la p\u00e1gina de invalidaci\u00f3n cuyo estado no est\u00e1 claro incluyendo bloqueado, sucio, reescritura, etc., por lo que debemos usar truncate_inode_pages_range() en lugar de invalidate_mapping_pages() para asegurarnos de que la p\u00e1gina meta_inode se elimine."}], "id": "CVE-2024-26869", "lastModified": "2026-10-30T13:17:22.617", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26869", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-06-12T17:28:33.962208Z", "version": "2.0.3"}}]}, "published": "2024-04-17T11:15:09.413", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0721a4f85d12a364002a9476c84b930fbc993f83"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: f2fs: fix to truncate meta inode pages forcely", "id": "2275713", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2275713"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-362", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nf2fs: fix to truncate meta inode pages forcely\nBelow race case can cause data corruption:\nThread AGC thread\n- gc_data_segment\n- ra_data_block\n- locked meta_inode page\n- f2fs_inplace_write_data\n- invalidate_mapping_pages\n: fail to invalidate meta_inode page\ndue to lock failure or dirty|writeback\nstatus\n- f2fs_submit_page_bio\n: write last dirty data to old blkaddr\n- move_data_block\n- load old data from meta_inode page\n- f2fs_submit_page_write\n: write old data to new blkaddr\nBecause invalidate_mapping_pages() will skip invalidating page which\nhas unclear status including locked, dirty, writeback and so on, so\nwe need to use truncate_inode_pages_range() instead of\ninvalidate_mapping_pages() to make sure meta_inode page will be dropped.", "A vulnerability was found in the f2fs component in the Linux kernel, where a race condition can be created between the garbage collection thread and the f2fs_inplace_write_data() thread. This could lead to data corruption or system instability."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-26869", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26869\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26869\nhttps://lore.kernel.org/linux-cve-announce/2024041738-CVE-2024-26869-c9e2@gregkh/T"], "statement": "Red Hat Enterprise Linux is not impacted by this CVE, as this vulnerability does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue and no further action or mitigation is necessary for systems running this operating system.", "threat_severity": "Moderate"}

{}