CVE-2024-38583

nilfs2: fix use-after-free of timer for log writer thread

State: Published
Severity: 7.8 High
Published: Jun 19, 2024
Updated: Aug 5, 2026
Reserved: Jun 18, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix use-after-free of timer for log writer thread

Patch series "nilfs2: fix log writer related issues".

This bug fix series covers three nilfs2 log writer-related issues, including a timer use-after-free issue and potential deadlock issue on unmount, and a potential freeze issue in event synchronization found during their analysis. Details are described in each commit log.

This patch (of 3):

A use-after-free issue has been reported regarding the timer sc_timer on the nilfs_sc_info structure.

The problem is that even though it is used to wake up a sleeping log writer thread, sc_timer is not shut down until the nilfs_sc_info structure is about to be freed, and is used regardless of the thread's lifetime.

Fix this issue by limiting the use of sc_timer only while the log writer thread is alive.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 822ae5a8eac30478578a75f7e064f0584931bf2dAffected fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 82933c84f188dcfe89eb26b0b48ab5d1ca99d164Affected fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148Affected fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before e65ccf3a4de4f0c763d94789615b83e11f204438Affected fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 86a30d6302deddb9fb97ba6fc4b04d0e870b582aAffected fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before f9186bba4ea282b07293c1c892441df3a5441cb0Affected fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 2f12b2c03c5dae1a0de0a9e5853177e3d6eee3c6Affected fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 68e738be5c518fc3c4e9146b66f67c8fee0135fbAffected fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before f5d4e04634c9cf68bdf23de08ada0bb92e8befe7Affected
LinuxLinux	2.6.35Affected before 2.6.35Not affected 4.19.316 through 4.19.Not affected 5.4.278 through 5.4.Not affected 5.10.219 through 5.10.Not affected 5.15.161 through 5.15.Not affected 6.1.94 through 6.1.Not affected 6.6.33 through 6.6.Not affected 6.8.12 through 6.8.Not affected 6.9.3 through 6.9.Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 822ae5a8eac30478578a75f7e064f0584931bf2dAffected
fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 82933c84f188dcfe89eb26b0b48ab5d1ca99d164Affected
fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148Affected
fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before e65ccf3a4de4f0c763d94789615b83e11f204438Affected
fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 86a30d6302deddb9fb97ba6fc4b04d0e870b582aAffected
fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before f9186bba4ea282b07293c1c892441df3a5441cb0Affected
fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 2f12b2c03c5dae1a0de0a9e5853177e3d6eee3c6Affected
fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before 68e738be5c518fc3c4e9146b66f67c8fee0135fbAffected
fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to before f5d4e04634c9cf68bdf23de08ada0bb92e8befe7Affected

LinuxLinux

2.6.35Affected
before 2.6.35Not affected
4.19.316 through 4.19.*Not affected
5.4.278 through 5.4.*Not affected
5.10.219 through 5.10.*Not affected
5.15.161 through 5.15.*Not affected
6.1.94 through 6.1.*Not affected
6.6.33 through 6.6.*Not affected
6.8.12 through 6.8.*Not affected
6.9.3 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.