CVE-2024-37078

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-37078", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-24T13:54:11.068Z", "datePublished": "2024-06-25T14:22:35.558Z", "dateUpdated": "2026-08-05T11:32:29.653Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:29.653Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential kernel bug due to lack of writeback flag waiting\n\nDestructive writes to a block device on which nilfs2 is mounted can cause\na kernel bug in the folio/page writeback start routine or writeback end\nroutine (__folio_start_writeback in the log below):\n\n kernel BUG at mm/page-writeback.c:3070!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\n ...\n RIP: 0010:__folio_start_writeback+0xbaa/0x10e0\n Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff\n e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f>\n 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00\n ...\n Call Trace:\n <TASK>\n nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2]\n nilfs_segctor_construct+0x181/0x6b0 [nilfs2]\n nilfs_segctor_thread+0x548/0x11c0 [nilfs2]\n kthread+0x2f0/0x390\n ret_from_fork+0x4b/0x80\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nThis is because when the log writer starts a writeback for segment summary\nblocks or a super root block that use the backing device's page cache, it\ndoes not wait for the ongoing folio/page writeback, resulting in an\ninconsistent writeback state.\n\nFix this issue by waiting for ongoing writebacks when putting\nfolios/pages on the backing device into writeback state."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access to the system to write to the block device node backing a mounted nilfs2 filesystem and to generate filesystem activity that drives log construction. There is no remote or adjacent-network path into fs/nilfs2/segment.c.\nAC:L - Although the flaw is a race between the block-device writeback path and the nilfs2 log writer, the attacker controls both sides \u2014 issuing the buffered device writes plus sync/fsync, and driving segment construction via filesystem I/O \u2014 and can retry in a tight loop until it lands. The fix author reproduced it deterministically with ordinary destructive device writes.\nPR:L - Only an unprivileged local account with write access to the device node is needed (disk-group service accounts, logind/udisks-ACL'd removable media on desktops and kiosks, or a container granted the device); no CAP_SYS_ADMIN is required for the triggering writes themselves.\nUI:N - Once a nilfs2 filesystem is mounted \u2014 a routine system state, not an attacker-supplied crafted image \u2014 the attacker acts entirely alone. No victim action is needed at any point in the attack.\nS:U - The corruption is confined to kernel page-cache state and the kernel's own memory; no VM, IOMMU, or sandbox boundary is crossed. Impact and vulnerable component share the same security authority.\nC:H - Premature clearing of PG_writeback removes the only protection keeping the folio alive under in-flight I/O (bio_add_folio takes no page reference), so the page can be truncated/reclaimed and reused while nilfs2's write bio still DMAs from it \u2014 leaking arbitrary reused kernel page contents onto the block device, which the attacker can read back.\nI:H - The same broken invariant makes nilfs2's completion handler call folio_end_writeback() on freed folio memory, a use-after-free write into a reclaimed and potentially heap-sprayed object, which is the classic primitive for control-flow hijacking. Filesystem metadata is additionally written from a page concurrently mutated by another writer.\nA:H - The documented outcome is a kernel BUG()/oops in the segctor kthread (mm/page-writeback.c), and on non-DEBUG_VM kernels the XOR in __folio_end_writeback re-sets PG_writeback on an idle folio, producing permanently hung unkillable tasks in folio_wait_writeback() plus writeback-accounting skew that stalls system-wide dirty throttling."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nilfs2/segment.c"], "versions": [{"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "95f6f81e50d858a7c9aa7c795ec14a0ac3819118", "status": "affected", "versionType": "git"}, {"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "a75b8f493dfc48aa38c518430bd9e03b53bffebe", "status": "affected", "versionType": "git"}, {"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "0ecfe3a92869a59668d27228dabbd7965e83567f", "status": "affected", "versionType": "git"}, {"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "33900d7eae616647e179eee1c66ebe654ee39627", "status": "affected", "versionType": "git"}, {"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "271dcd977ccda8c7a26e360425ae7b4db7d2ecc0", "status": "affected", "versionType": "git"}, {"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "614d397be0cf43412b3f94a0f6460eddced8ce92", "status": "affected", "versionType": "git"}, {"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "1f3bff69f1214fe03a02bc650d5bbfaa6e65ae7d", "status": "affected", "versionType": "git"}, {"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "a4ca369ca221bb7e06c725792ac107f0e48e82e7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nilfs2/segment.c"], "versions": [{"version": "2.6.30", "status": "affected"}, {"version": "0", "lessThan": "2.6.30", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.317", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.279", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.221", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.162", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.95", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.35", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.5", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "4.19.317"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.4.279"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.10.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.15.162"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.1.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.6.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.9.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/95f6f81e50d858a7c9aa7c795ec14a0ac3819118"}, {"url": "https://git.kernel.org/stable/c/a75b8f493dfc48aa38c518430bd9e03b53bffebe"}, {"url": "https://git.kernel.org/stable/c/0ecfe3a92869a59668d27228dabbd7965e83567f"}, {"url": "https://git.kernel.org/stable/c/33900d7eae616647e179eee1c66ebe654ee39627"}, {"url": "https://git.kernel.org/stable/c/271dcd977ccda8c7a26e360425ae7b4db7d2ecc0"}, {"url": "https://git.kernel.org/stable/c/614d397be0cf43412b3f94a0f6460eddced8ce92"}, {"url": "https://git.kernel.org/stable/c/1f3bff69f1214fe03a02bc650d5bbfaa6e65ae7d"}, {"url": "https://git.kernel.org/stable/c/a4ca369ca221bb7e06c725792ac107f0e48e82e7"}], "title": "nilfs2: fix potential kernel bug due to lack of writeback flag waiting", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/95f6f81e50d858a7c9aa7c795ec14a0ac3819118", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a75b8f493dfc48aa38c518430bd9e03b53bffebe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0ecfe3a92869a59668d27228dabbd7965e83567f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/33900d7eae616647e179eee1c66ebe654ee39627", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/271dcd977ccda8c7a26e360425ae7b4db7d2ecc0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/614d397be0cf43412b3f94a0f6460eddced8ce92", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1f3bff69f1214fe03a02bc650d5bbfaa6e65ae7d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a4ca369ca221bb7e06c725792ac107f0e48e82e7", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:55:32.951Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-37078", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:08:24.419560Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:43.007Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/95f6f81e50d858a7c9aa7c795ec14a0ac3819118", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a75b8f493dfc48aa38c518430bd9e03b53bffebe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0ecfe3a92869a59668d27228dabbd7965e83567f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/33900d7eae616647e179eee1c66ebe654ee39627", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/271dcd977ccda8c7a26e360425ae7b4db7d2ecc0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/614d397be0cf43412b3f94a0f6460eddced8ce92", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1f3bff69f1214fe03a02bc650d5bbfaa6e65ae7d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a4ca369ca221bb7e06c725792ac107f0e48e82e7", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:55:32.951Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-37078", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:08:24.419560Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:25.347Z"}}], "cna": {"title": "nilfs2: fix potential kernel bug due to lack of writeback flag waiting", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "95f6f81e50d858a7c9aa7c795ec14a0ac3819118", "versionType": "git"}, {"status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "a75b8f493dfc48aa38c518430bd9e03b53bffebe", "versionType": "git"}, {"status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "0ecfe3a92869a59668d27228dabbd7965e83567f", "versionType": "git"}, {"status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "33900d7eae616647e179eee1c66ebe654ee39627", "versionType": "git"}, {"status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "271dcd977ccda8c7a26e360425ae7b4db7d2ecc0", "versionType": "git"}, {"status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "614d397be0cf43412b3f94a0f6460eddced8ce92", "versionType": "git"}, {"status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "1f3bff69f1214fe03a02bc650d5bbfaa6e65ae7d", "versionType": "git"}, {"status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "lessThan": "a4ca369ca221bb7e06c725792ac107f0e48e82e7", "versionType": "git"}], "programFiles": ["fs/nilfs2/segment.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.30"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.30", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.317", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.279", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.221", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.162", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.95", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.35", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.5", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nilfs2/segment.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/95f6f81e50d858a7c9aa7c795ec14a0ac3819118"}, {"url": "https://git.kernel.org/stable/c/a75b8f493dfc48aa38c518430bd9e03b53bffebe"}, {"url": "https://git.kernel.org/stable/c/0ecfe3a92869a59668d27228dabbd7965e83567f"}, {"url": "https://git.kernel.org/stable/c/33900d7eae616647e179eee1c66ebe654ee39627"}, {"url": "https://git.kernel.org/stable/c/271dcd977ccda8c7a26e360425ae7b4db7d2ecc0"}, {"url": "https://git.kernel.org/stable/c/614d397be0cf43412b3f94a0f6460eddced8ce92"}, {"url": "https://git.kernel.org/stable/c/1f3bff69f1214fe03a02bc650d5bbfaa6e65ae7d"}, {"url": "https://git.kernel.org/stable/c/a4ca369ca221bb7e06c725792ac107f0e48e82e7"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential kernel bug due to lack of writeback flag waiting\n\nDestructive writes to a block device on which nilfs2 is mounted can cause\na kernel bug in the folio/page writeback start routine or writeback end\nroutine (__folio_start_writeback in the log below):\n\n kernel BUG at mm/page-writeback.c:3070!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\n ...\n RIP: 0010:__folio_start_writeback+0xbaa/0x10e0\n Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff\n e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f>\n 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00\n ...\n Call Trace:\n <TASK>\n nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2]\n nilfs_segctor_construct+0x181/0x6b0 [nilfs2]\n nilfs_segctor_thread+0x548/0x11c0 [nilfs2]\n kthread+0x2f0/0x390\n ret_from_fork+0x4b/0x80\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nThis is because when the log writer starts a writeback for segment summary\nblocks or a super root block that use the backing device's page cache, it\ndoes not wait for the ongoing folio/page writeback, resulting in an\ninconsistent writeback state.\n\nFix this issue by waiting for ongoing writebacks when putting\nfolios/pages on the backing device into writeback state."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.317", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.279", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.221", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.162", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.95", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.35", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.5", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "2.6.30"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T09:13:19.759Z"}}}, "cveMetadata": {"cveId": "CVE-2024-37078", "state": "PUBLISHED", "dateUpdated": "2025-11-03T21:55:32.951Z", "dateReserved": "2024-06-24T13:54:11.068Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-25T14:22:35.558Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nilfs2/segment.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "95f6f81e50d858a7c9aa7c795ec14a0ac3819118", "status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "versionType": "git"}, {"lessThan": "a75b8f493dfc48aa38c518430bd9e03b53bffebe", "status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "versionType": "git"}, {"lessThan": "0ecfe3a92869a59668d27228dabbd7965e83567f", "status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "versionType": "git"}, {"lessThan": "33900d7eae616647e179eee1c66ebe654ee39627", "status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "versionType": "git"}, {"lessThan": "271dcd977ccda8c7a26e360425ae7b4db7d2ecc0", "status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "versionType": "git"}, {"lessThan": "614d397be0cf43412b3f94a0f6460eddced8ce92", "status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "versionType": "git"}, {"lessThan": "1f3bff69f1214fe03a02bc650d5bbfaa6e65ae7d", "status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "versionType": "git"}, {"lessThan": "a4ca369ca221bb7e06c725792ac107f0e48e82e7", "status": "affected", "version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nilfs2/segment.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.30"}, {"lessThan": "2.6.30", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.317", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.279", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.221", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.162", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.95", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.35", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF5B4A8B-7656-4B90-975E-8E35F79051DE", "versionEndExcluding": "4.19.317", "versionStartIncluding": "2.6.30", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F4E38E58-1B9F-4DF2-AD3D-A8BEAA2959D8", "versionEndExcluding": "5.4.279", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "659E1520-6345-41AF-B893-A7C0647585A0", "versionEndExcluding": "5.10.221", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "10A39ACC-3005-40E8-875C-98A372D1FFD5", "versionEndExcluding": "5.15.162", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D435765D-2766-44F5-B319-F713A13E35CE", "versionEndExcluding": "6.1.95", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F019D15-84C0-416B-8C57-7F51B68992F0", "versionEndExcluding": "6.6.35", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8366481F-770F-4850-9D0F-2977BD97D5C5", "versionEndExcluding": "6.9.5", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential kernel bug due to lack of writeback flag waiting\n\nDestructive writes to a block device on which nilfs2 is mounted can cause\na kernel bug in the folio/page writeback start routine or writeback end\nroutine (__folio_start_writeback in the log below):\n\n kernel BUG at mm/page-writeback.c:3070!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\n ...\n RIP: 0010:__folio_start_writeback+0xbaa/0x10e0\n Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff\n e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f>\n 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00\n ...\n Call Trace:\n <TASK>\n nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2]\n nilfs_segctor_construct+0x181/0x6b0 [nilfs2]\n nilfs_segctor_thread+0x548/0x11c0 [nilfs2]\n kthread+0x2f0/0x390\n ret_from_fork+0x4b/0x80\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nThis is because when the log writer starts a writeback for segment summary\nblocks or a super root block that use the backing device's page cache, it\ndoes not wait for the ongoing folio/page writeback, resulting in an\ninconsistent writeback state.\n\nFix this issue by waiting for ongoing writebacks when putting\nfolios/pages on the backing device into writeback state."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nilfs2: corrige un posible error en el kernel debido a la falta de indicador de escritura reescrita en espera Las escrituras destructivas en un dispositivo de bloque en el que est\u00e1 montado nilfs2 pueden causar un error en el kernel en la rutina de inicio de reescritura de folio/p\u00e1gina o Rutina de fin de reescritura (__folio_start_writeback en el registro a continuaci\u00f3n): \u00a1ERROR del kernel en mm/page-writeback.c:3070! Vaya: c\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 [#1] PREEMPT SMP KASAN PTI... RIP: 0010:__folio_start_writeback+0xbaa/0x10e0 C\u00f3digo: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 &lt;0f&gt; 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00 ... Seguimiento de llamadas: nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2] nilfs_segctor_construct+0x181/0x6b0 [nilfs2] nilfs_segctor_thread+0x548/0x11c0 [nilfs2] kthread+0x2f0/0x390 ret_from_fork+0x4b/0x 80 ret_from_fork_asm+0x1a/0x30 Esto se debe a que cuando el escritor de registros inicia una reescritura para bloques de resumen de segmentos o un bloque s\u00faper ra\u00edz que utiliza la cach\u00e9 de p\u00e1gina del dispositivo de respaldo, no espera la reescritura en curso de folios/p\u00e1ginas, lo que genera un estado de reescritura inconsistente. Solucione este problema esperando las reescrituras en curso al poner las publicaciones/p\u00e1ginas en el dispositivo de respaldo en estado de reescritura."}], "id": "CVE-2024-37078", "lastModified": "2026-08-04T11:18:38.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-37078", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:08:24.419560Z", "version": "2.0.3"}}]}, "published": "2024-06-25T15:15:12.287", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0ecfe3a92869a59668d27228dabbd7965e83567f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1f3bff69f1214fe03a02bc650d5bbfaa6e65ae7d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/271dcd977ccda8c7a26e360425ae7b4db7d2ecc0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/33900d7eae616647e179eee1c66ebe654ee39627"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/614d397be0cf43412b3f94a0f6460eddced8ce92"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/95f6f81e50d858a7c9aa7c795ec14a0ac3819118"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a4ca369ca221bb7e06c725792ac107f0e48e82e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a75b8f493dfc48aa38c518430bd9e03b53bffebe"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0ecfe3a92869a59668d27228dabbd7965e83567f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1f3bff69f1214fe03a02bc650d5bbfaa6e65ae7d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/271dcd977ccda8c7a26e360425ae7b4db7d2ecc0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/33900d7eae616647e179eee1c66ebe654ee39627"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/614d397be0cf43412b3f94a0f6460eddced8ce92"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/95f6f81e50d858a7c9aa7c795ec14a0ac3819118"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a4ca369ca221bb7e06c725792ac107f0e48e82e7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a75b8f493dfc48aa38c518430bd9e03b53bffebe"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nilfs2: fix potential kernel bug due to lack of writeback flag waiting", "id": "2294285", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294285"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnilfs2: fix potential kernel bug due to lack of writeback flag waiting\nDestructive writes to a block device on which nilfs2 is mounted can cause\na kernel bug in the folio/page writeback start routine or writeback end\nroutine (__folio_start_writeback in the log below):\nkernel BUG at mm/page-writeback.c:3070!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\n...\nRIP: 0010:__folio_start_writeback+0xbaa/0x10e0\nCode: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff\ne8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f>\n0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00\n...\nCall Trace:\n<TASK>\nnilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2]\nnilfs_segctor_construct+0x181/0x6b0 [nilfs2]\nnilfs_segctor_thread+0x548/0x11c0 [nilfs2]\nkthread+0x2f0/0x390\nret_from_fork+0x4b/0x80\nret_from_fork_asm+0x1a/0x30\n</TASK>\nThis is because when the log writer starts a writeback for segment summary\nblocks or a super root block that use the backing device's page cache, it\ndoes not wait for the ongoing folio/page writeback, resulting in an\ninconsistent writeback state.\nFix this issue by waiting for ongoing writebacks when putting\nfolios/pages on the backing device into writeback state."], "name": "CVE-2024-37078", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-37078\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-37078\nhttps://lore.kernel.org/linux-cve-announce/2024062547-CVE-2024-37078-3aaa@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-07-12T22:23:50.209884+00:00", "updated": "2025-07-12T22:23:50.209935+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}