CVE-2024-46781

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-46781", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.276Z", "datePublished": "2024-09-18T07:12:37.603Z", "dateUpdated": "2026-08-05T11:38:32.082Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:32.082Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix missing cleanup on rollforward recovery error\n\nIn an error injection test of a routine for mount-time recovery, KASAN\nfound a use-after-free bug.\n\nIt turned out that if data recovery was performed using partial logs\ncreated by dsync writes, but an error occurred before starting the log\nwriter to create a recovered checkpoint, the inodes whose data had been\nrecovered were left in the ns_dirty_files list of the nilfs object and\nwere not freed.\n\nFix this issue by cleaning up inodes that have read the recovery data if\nthe recovery routine fails midway before the log writer starts."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through `mount()` of an attacker-crafted nilfs2 block device/image, i.e. local system access; there is no network-facing path into `load_nilfs()`/`nilfs_salvage_orphan_logs()`.\nAC:L - The failure is deterministically driven by the on-disk log layout \u2014 a valid dsync log group that dirties inodes followed by a segment with `NILFS_SS_SR` set forces `goto confused`/`-EINVAL` after `ns_dirty_files` is populated \u2014 with no race or environmental condition outside the attacker's control.\nPR:L - In the most severe realistic deployment (desktop/kiosk/embedded systems with udisks2 or autofs auto-mounting removable media, or fstab `user` mounts), an unprivileged local actor supplies the image and the mount happens on their behalf without any elevated credentials of their own.\nUI:N - The attacker performs or triggers the mount themselves (inserting their own media on a shared/kiosk machine or invoking a permitted mount); no action by a separate victim user is needed.\nS:U - The corruption is confined to kernel memory managed by the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The leaked inodes retain dangling pointers to the freed `nilfs_root`, `the_nilfs` and `super_block`; reclaiming those kmalloc objects with attacker-sprayed data and then touching the stale inodes yields type-confused reads of kernel memory, so full confidentiality loss is achievable.\nI:H - The same use-after-free provides a write side \u2014 writeback of the leaked dirty folios and `nilfs_evict_inode()`/`nilfs_put_root()` paths dereference and mutate the freed structures, giving heap-spray-controlled write primitives usable for control-flow hijack.\nA:H - Even unweaponized, the dangling `i_sb`/`i_root`/`s_fs_info` references and the busy-inode leak reliably produce a kernel oops or panic during or after the failed mount."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nilfs2/recovery.c"], "versions": [{"version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "35a9a7a7d94662146396199b0cfd95f9517cdd14", "status": "affected", "versionType": "git"}, {"version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "da02f9eb333333b2e4f25d2a14967cff785ac82e", "status": "affected", "versionType": "git"}, {"version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "07e4dc2fe000ab008bcfe90be4324ef56b5b4355", "status": "affected", "versionType": "git"}, {"version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "8e2d1e9d93c4ec51354229361ac3373058529ec4", "status": "affected", "versionType": "git"}, {"version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "ca92c4bff2833cb30d493b935168d6cccd5c805d", "status": "affected", "versionType": "git"}, {"version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "9d8c3a585d564d776ee60d4aabec59b404be7403", "status": "affected", "versionType": "git"}, {"version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "1cf1f7e8cd47244fa947d357ef1f642d91e219a3", "status": "affected", "versionType": "git"}, {"version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "5787fcaab9eb5930f5378d6a1dd03d916d146622", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nilfs2/recovery.c"], "versions": [{"version": "2.6.30", "status": "affected"}, {"version": "0", "lessThan": "2.6.30", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.322", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.284", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.226", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.167", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.110", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.51", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.10", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "4.19.322"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.4.284"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.10.226"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.15.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.1.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.6.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.10.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/35a9a7a7d94662146396199b0cfd95f9517cdd14"}, {"url": "https://git.kernel.org/stable/c/da02f9eb333333b2e4f25d2a14967cff785ac82e"}, {"url": "https://git.kernel.org/stable/c/07e4dc2fe000ab008bcfe90be4324ef56b5b4355"}, {"url": "https://git.kernel.org/stable/c/8e2d1e9d93c4ec51354229361ac3373058529ec4"}, {"url": "https://git.kernel.org/stable/c/ca92c4bff2833cb30d493b935168d6cccd5c805d"}, {"url": "https://git.kernel.org/stable/c/9d8c3a585d564d776ee60d4aabec59b404be7403"}, {"url": "https://git.kernel.org/stable/c/1cf1f7e8cd47244fa947d357ef1f642d91e219a3"}, {"url": "https://git.kernel.org/stable/c/5787fcaab9eb5930f5378d6a1dd03d916d146622"}], "title": "nilfs2: fix missing cleanup on rollforward recovery error", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-29T14:37:59.673853Z", "id": "CVE-2024-46781", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T14:38:14.597Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:18:23.818Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:18:23.818Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-46781", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-29T14:37:59.673853Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T14:38:03.784Z"}}], "cna": {"title": "nilfs2: fix missing cleanup on rollforward recovery error", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through `mount()` of an attacker-crafted nilfs2 block device/image, i.e. local system access; there is no network-facing path into `load_nilfs()`/`nilfs_salvage_orphan_logs()`.\nAC:L - The failure is deterministically driven by the on-disk log layout \u2014 a valid dsync log group that dirties inodes followed by a segment with `NILFS_SS_SR` set forces `goto confused`/`-EINVAL` after `ns_dirty_files` is populated \u2014 with no race or environmental condition outside the attacker's control.\nPR:L - In the most severe realistic deployment (desktop/kiosk/embedded systems with udisks2 or autofs auto-mounting removable media, or fstab `user` mounts), an unprivileged local actor supplies the image and the mount happens on their behalf without any elevated credentials of their own.\nUI:N - The attacker performs or triggers the mount themselves (inserting their own media on a shared/kiosk machine or invoking a permitted mount); no action by a separate victim user is needed.\nS:U - The corruption is confined to kernel memory managed by the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The leaked inodes retain dangling pointers to the freed `nilfs_root`, `the_nilfs` and `super_block`; reclaiming those kmalloc objects with attacker-sprayed data and then touching the stale inodes yields type-confused reads of kernel memory, so full confidentiality loss is achievable.\nI:H - The same use-after-free provides a write side \u2014 writeback of the leaked dirty folios and `nilfs_evict_inode()`/`nilfs_put_root()` paths dereference and mutate the freed structures, giving heap-spray-controlled write primitives usable for control-flow hijack.\nA:H - Even unweaponized, the dangling `i_sb`/`i_root`/`s_fs_info` references and the busy-inode leak reliably produce a kernel oops or panic during or after the failed mount."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "35a9a7a7d94662146396199b0cfd95f9517cdd14", "versionType": "git"}, {"status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "da02f9eb333333b2e4f25d2a14967cff785ac82e", "versionType": "git"}, {"status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "07e4dc2fe000ab008bcfe90be4324ef56b5b4355", "versionType": "git"}, {"status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "8e2d1e9d93c4ec51354229361ac3373058529ec4", "versionType": "git"}, {"status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "ca92c4bff2833cb30d493b935168d6cccd5c805d", "versionType": "git"}, {"status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "9d8c3a585d564d776ee60d4aabec59b404be7403", "versionType": "git"}, {"status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "1cf1f7e8cd47244fa947d357ef1f642d91e219a3", "versionType": "git"}, {"status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "5787fcaab9eb5930f5378d6a1dd03d916d146622", "versionType": "git"}], "programFiles": ["fs/nilfs2/recovery.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.30"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.30", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.322", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.284", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.226", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.167", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.110", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.51", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.10", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nilfs2/recovery.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/35a9a7a7d94662146396199b0cfd95f9517cdd14"}, {"url": "https://git.kernel.org/stable/c/da02f9eb333333b2e4f25d2a14967cff785ac82e"}, {"url": "https://git.kernel.org/stable/c/07e4dc2fe000ab008bcfe90be4324ef56b5b4355"}, {"url": "https://git.kernel.org/stable/c/8e2d1e9d93c4ec51354229361ac3373058529ec4"}, {"url": "https://git.kernel.org/stable/c/ca92c4bff2833cb30d493b935168d6cccd5c805d"}, {"url": "https://git.kernel.org/stable/c/9d8c3a585d564d776ee60d4aabec59b404be7403"}, {"url": "https://git.kernel.org/stable/c/1cf1f7e8cd47244fa947d357ef1f642d91e219a3"}, {"url": "https://git.kernel.org/stable/c/5787fcaab9eb5930f5378d6a1dd03d916d146622"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix missing cleanup on rollforward recovery error\n\nIn an error injection test of a routine for mount-time recovery, KASAN\nfound a use-after-free bug.\n\nIt turned out that if data recovery was performed using partial logs\ncreated by dsync writes, but an error occurred before starting the log\nwriter to create a recovered checkpoint, the inodes whose data had been\nrecovered were left in the ns_dirty_files list of the nilfs object and\nwere not freed.\n\nFix this issue by cleaning up inodes that have read the recovery data if\nthe recovery routine fails midway before the log writer starts."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.322", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.284", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.226", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.167", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.110", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.51", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.10", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "2.6.30"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:32.082Z"}}}, "cveMetadata": {"cveId": "CVE-2024-46781", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:38:32.082Z", "dateReserved": "2024-09-11T15:12:18.276Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-09-18T07:12:37.603Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nilfs2/recovery.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "35a9a7a7d94662146396199b0cfd95f9517cdd14", "status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "versionType": "git"}, {"lessThan": "da02f9eb333333b2e4f25d2a14967cff785ac82e", "status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "versionType": "git"}, {"lessThan": "07e4dc2fe000ab008bcfe90be4324ef56b5b4355", "status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "versionType": "git"}, {"lessThan": "8e2d1e9d93c4ec51354229361ac3373058529ec4", "status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "versionType": "git"}, {"lessThan": "ca92c4bff2833cb30d493b935168d6cccd5c805d", "status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "versionType": "git"}, {"lessThan": "9d8c3a585d564d776ee60d4aabec59b404be7403", "status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "versionType": "git"}, {"lessThan": "1cf1f7e8cd47244fa947d357ef1f642d91e219a3", "status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "versionType": "git"}, {"lessThan": "5787fcaab9eb5930f5378d6a1dd03d916d146622", "status": "affected", "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nilfs2/recovery.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.30"}, {"lessThan": "2.6.30", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.322", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.284", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.226", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.167", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.110", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.51", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9128926-755C-411A-BEB6-1FE3B3ADA74E", "versionEndExcluding": "4.19.322", "versionStartIncluding": "2.6.30", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6265A402-9C3C-438F-BFC5-4194B2568B85", "versionEndExcluding": "5.4.284", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "864FC17C-501A-4823-A643-6F35D65D8A97", "versionEndExcluding": "5.10.226", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "043405A4-25FE-45D4-A7BB-2A0C3B7D17C1", "versionEndExcluding": "5.15.167", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B1A95FC-7E7E-428B-BB59-F76640C652AE", "versionEndExcluding": "6.1.110", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4529134-BAC4-4776-840B-304009E181A0", "versionEndExcluding": "6.6.51", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACDEE48C-137A-4731-90D0-A675865E1BED", "versionEndExcluding": "6.10.10", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*", "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*", "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*", "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*", "matchCriteriaId": "39889A68-6D34-47A6-82FC-CD0BF23D6754", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*", "matchCriteriaId": "B8383ABF-1457-401F-9B61-EE50F4C61F4F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*", "matchCriteriaId": "B77A9280-37E6-49AD-B559-5B23A3B1DC3D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix missing cleanup on rollforward recovery error\n\nIn an error injection test of a routine for mount-time recovery, KASAN\nfound a use-after-free bug.\n\nIt turned out that if data recovery was performed using partial logs\ncreated by dsync writes, but an error occurred before starting the log\nwriter to create a recovered checkpoint, the inodes whose data had been\nrecovered were left in the ns_dirty_files list of the nilfs object and\nwere not freed.\n\nFix this issue by cleaning up inodes that have read the recovery data if\nthe recovery routine fails midway before the log writer starts."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nilfs2: se corrige el error de limpieza faltante en la recuperaci\u00f3n de avance En una prueba de inyecci\u00f3n de errores de una rutina para la recuperaci\u00f3n en tiempo de montaje, KASAN encontr\u00f3 un error de use after free. Result\u00f3 que si la recuperaci\u00f3n de datos se realizaba utilizando registros parciales creados por escrituras dsync, pero se produc\u00eda un error antes de iniciar el escritor de registros para crear un punto de control recuperado, los inodos cuyos datos se hab\u00edan recuperado se dejaban en la lista ns_dirty_files del objeto nilfs y no se liberaban. Solucione este problema limpiando los inodos que han le\u00eddo los datos de recuperaci\u00f3n si la rutina de recuperaci\u00f3n falla a mitad de camino antes de que se inicie el escritor de registros."}], "id": "CVE-2024-46781", "lastModified": "2026-08-04T11:20:25.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-46781", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-29T14:37:59.673853Z", "version": "2.0.3"}}]}, "published": "2024-09-18T08:15:05.527", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/07e4dc2fe000ab008bcfe90be4324ef56b5b4355"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1cf1f7e8cd47244fa947d357ef1f642d91e219a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/35a9a7a7d94662146396199b0cfd95f9517cdd14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5787fcaab9eb5930f5378d6a1dd03d916d146622"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8e2d1e9d93c4ec51354229361ac3373058529ec4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9d8c3a585d564d776ee60d4aabec59b404be7403"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca92c4bff2833cb30d493b935168d6cccd5c805d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/da02f9eb333333b2e4f25d2a14967cff785ac82e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nilfs2: fix missing cleanup on rollforward recovery error", "id": "2313130", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313130"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnilfs2: fix missing cleanup on rollforward recovery error\nIn an error injection test of a routine for mount-time recovery, KASAN\nfound a use-after-free bug.\nIt turned out that if data recovery was performed using partial logs\ncreated by dsync writes, but an error occurred before starting the log\nwriter to create a recovered checkpoint, the inodes whose data had been\nrecovered were left in the ns_dirty_files list of the nilfs object and\nwere not freed.\nFix this issue by cleaning up inodes that have read the recovery data if\nthe recovery routine fails midway before the log writer starts."], "name": "CVE-2024-46781", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-09-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-46781\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-46781\nhttps://lore.kernel.org/linux-cve-announce/2024091850-CVE-2024-46781-377e@gregkh/T"], "threat_severity": "Moderate"}

{}