Riskcovery

CVE-2024-35821

ubifs: Set page uptodate in the correct place

State
Published
Severity
7.5 High
Published
May 17, 2024
Updated
May 11, 2026
Reserved
May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ubifs: Set page uptodate in the correct place

Page cache reads are lockless, so setting the freshly allocated page uptodate before we've overwritten it with the data it's supposed to have in it will allow a simultaneous reader to see old data. Move the call to SetPageUptodate into ubifs_write_end(), which is after we copied the new data into the page.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCISA-ADP

Weaknesses

  • CWE-772 Missing Release of Resource after Effective Lifetime

Affected Products

ProductVersions
LinuxLinux
  • 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 4aa554832b9dc9e66249df75b8f447d87853e12eAffected
  • 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 778c6ad40256f1c03244fc06d7cdf71f6b5e7310Affected
  • 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 8f599ab6fabbca4c741107eade70722a98adfd9fAffected
  • 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before f19b1023a3758f40791ec166038d6411c8894ae3Affected
  • 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 142d87c958d9454c3cffa625fab56f3016e8f9f3Affected
  • 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before fc99f4e2d2f1ce766c14e98463c2839194ae964fAffected
  • 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 4b7c4fc60d6a46350fbe54f5dc937aeaa02e675eAffected
  • 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 17772bbe9cfa972ea1ff827319f6e1340de76566Affected
  • 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d to before 723012cab779eee8228376754e22c6594229bf8fAffected
LinuxLinux
  • 2.6.27Affected
  • before 2.6.27Not affected
  • 4.19.312 through 4.19.*Not affected
  • 5.4.274 through 5.4.*Not affected
  • 5.10.215 through 5.10.*Not affected
  • 5.15.154 through 5.15.*Not affected
  • 6.1.84 through 6.1.*Not affected
  • 6.6.24 through 6.6.*Not affected
  • 6.7.12 through 6.7.*Not affected
  • 6.8.3 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.