CVE-2024-26772

ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()

State: Published
Severity: 7.8 High
Published: Apr 3, 2024
Updated: Oct 15, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()

Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before 5a6dcc4ad0f7f7fa8e8d127b5526e7c5f2d38a43Affected 163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before 6b92b1bc16d691c95b152c6dbf027ad64315668dAffected 163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before ffeb72a80a82aba59a6774b0611f792e0ed3b0b7Affected 163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before 8de8305a25bfda607fc13475ebe84b978c96d7ffAffected 163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before d639102f4cbd4cb65d1225dba3b9265596aab586Affected 163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before d3bbe77a76bc52e9d4d0a120f1509be36e25c916Affected 163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before 21dbe20589c7f48e9c5d336ce6402bcebfa6d76aAffected 163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before 832698373a25950942c04a512daa652c18a9b513Affected
LinuxLinux	3.12Affected before 3.12Not affected 4.19.308 through 4.19.Not affected 5.4.270 through 5.4.Not affected 5.10.211 through 5.10.Not affected 5.15.150 through 5.15.Not affected 6.1.80 through 6.1.Not affected 6.6.19 through 6.6.Not affected 6.7.7 through 6.7.*Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before 5a6dcc4ad0f7f7fa8e8d127b5526e7c5f2d38a43Affected
163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before 6b92b1bc16d691c95b152c6dbf027ad64315668dAffected
163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before ffeb72a80a82aba59a6774b0611f792e0ed3b0b7Affected
163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before 8de8305a25bfda607fc13475ebe84b978c96d7ffAffected
163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before d639102f4cbd4cb65d1225dba3b9265596aab586Affected
163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before d3bbe77a76bc52e9d4d0a120f1509be36e25c916Affected
163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before 21dbe20589c7f48e9c5d336ce6402bcebfa6d76aAffected
163a203ddb36c36d4a1c942aececda0cc8d06aa7 to before 832698373a25950942c04a512daa652c18a9b513Affected

LinuxLinux

3.12Affected
before 3.12Not affected
4.19.308 through 4.19.*Not affected
5.4.270 through 5.4.*Not affected
5.10.211 through 5.10.*Not affected
5.15.150 through 5.15.*Not affected
6.1.80 through 6.1.*Not affected
6.6.19 through 6.6.*Not affected
6.7.7 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.